# Vibe Code Security Reviewer (ChatGPT Plugin)

> Audit real security risks

- Type: plugin
- Publisher: The Doers Firm
- Categories: Security, Development
- Website: https://chatgpt.com/plugins/plugins_6ab01c9056c481918eac972df8fb396d
- Open in ChatGPT: https://chatgpt.com/plugins/plugins_6ab01c9056c481918eac972df8fb396d
- Version: 0.1.0
- Listed: 2026-10-15

## About

Vibe Code Security Reviewer performs advanced evidence-based security reviews of AI-generated and rapidly built applications. It checks Supabase RLS, authentication, authorization, tenant isolation, API leaks and misuse, inputs, secrets, uploads, dependencies, data exposure, AI tools, deployment configuration, and abuse paths, then prioritizes findings with practical remediation and verification steps.

## Install

1. **Add it in ChatGPT** Open Plugins in the ChatGPT sidebar (web or desktop), search for “Vibe Code Security Reviewer” and select +. You'll be asked to sign in to any connected service on first use. Then type @ in a chat to call it.

## Disconnect or uninstall

1. **In ChatGPT** Disconnect an account in Settings → Apps or Plugins. To remove the plugin itself, open Vibe Code Security Reviewer in the Plugin Directory and select Uninstall plugin. Uninstalling can disconnect every account connected through it, and plugins your workspace installs may not offer the option.

2. **In Codex** Run /plugins in the Codex CLI, select the plugin and uninstall it, or press Space to turn it off.

## Skills

- **ai-application-security**: Review AI features for prompt injection, data leakage, tool abuse, unsafe output, and excessive agency.
- **api-abuse-and-misuse**: Review APIs for broken object authorization, excessive data, unsafe methods, rate-limit gaps, and abuse paths.
- **api-leak-and-key-security**: Detect API keys, service credentials, tokens, and privileged endpoints leaked to clients or repositories.
- **authentication-and-authorization**: Review login, sessions, tokens, roles, permissions, tenant isolation, and privileged actions.
- **cloudflare-and-deployment-security**: Review Workers, Pages, storage bindings, deployment configuration, and production security controls.
- **dependencies-and-supply-chain**: Review packages, lockfiles, scripts, provenance, licensing, advisories, and dependency risk.
- **edge-functions-and-webhooks**: Review serverless functions, webhooks, signatures, retries, idempotency, and privileged execution.
- **observability-and-incident-response**: Review security logging, alerting, audit trails, containment, recovery, and post-incident evidence.
- **postgres-database-security**: Review PostgreSQL schemas, grants, functions, views, migrations, and query safety.
- **privacy-and-data-governance**: Review collection, minimization, retention, consent, logging, export, deletion, and third-party data flows.
- **realtime-and-messaging-security**: Review realtime channels, WebSockets, queues, broadcasts, subscriptions, and message authorization.
- **secrets-and-data-protection**: Find exposed secrets and review sensitive-data collection, storage, logging, and transmission.
- **security-review-reporting**: Produce concise, evidence-backed security reports for developers and stakeholders.
- **security-testing-and-remediation**: Convert findings into safe tests, prioritized fixes, regression coverage, and verification evidence.
- **storage-and-upload-security**: Review object storage, file uploads, MIME validation, path ownership, malware risk, and download authorization.

## Example prompts

- "Audit this app for the highest-risk vulnerabilities."
- "Review this authentication flow and find bypasses."
- "Check this AI-generated code before production."

## Vibe Code Security Reviewer alternatives

- [Superpowers](https://chatgptplugins.directory/plugins/superpowers.md): Plan, develop, and debug code
- [Codex Security](https://chatgptplugins.directory/plugins/codex-security.md): Security scanning for your codebase
- [Build Web Apps](https://chatgptplugins.directory/plugins/build-web-apps.md): Build frontend-focused web apps with generated assets, browser testing, payments, and...
- [GitHub](https://chatgptplugins.directory/plugins/github.md): Triage PRs, issues, CI, and publish flows
- [Figma](https://chatgptplugins.directory/plugins/figma.md): Figma design-to-code workflows
- [Shopify](https://chatgptplugins.directory/plugins/shopify.md): Build and manage your store

---
Source: https://chatgptplugins.directory/plugins/vibe-code-security-reviewer · Index: https://chatgptplugins.directory/llms.txt · Independent and community-run. Not affiliated with or endorsed by OpenAI. ChatGPT is a trademark of OpenAI.