ac-framework 2.3.0 → 2.4.0

package/framework/web_development/.clinerules/workflows/ac-lite.md

@@ -61,6 +61,57 @@ acfm memory stats
 
 ---
 
+
+## SynapseGrid Collaboration Protocol (Optional but Recommended for Complex Tasks)
+
+Use SynapseGrid when a task benefits from role-based collaboration and explicit review loops.
+
+**Delegate to SynapseGrid when:**
+- Scope spans planning + implementation + review
+- Risk is medium/high (security, migrations, API contract changes)
+- You need auditable outputs (transcript, meeting summary, artifacts)
+- A single-pass implementation is likely to miss edge cases
+
+**Role delegation map:**
+- `planner` -> plan/constraints/acceptance criteria
+- `critic` -> risk analysis and challenge assumptions
+- `coder` -> implementation and concrete edits
+- `reviewer` -> final verification and readiness checks
+
+**Preferred MCP flow:**
+1. `collab_start_session`
+2. `collab_invoke_team`
+3. `collab_wait_run`
+4. `collab_get_result`
+5. Optional: `collab_get_transcript`, `collab_get_meeting_log`, `collab_status`
+
+**CLI fallback:**
+```bash
+acfm agents setup
+acfm agents runtime set auto
+acfm agents doctor --verbose
+acfm agents start --task "..." --mux auto
+acfm agents transcript --role all --limit 80
+acfm agents summary
+acfm agents artifacts --watch --interval 1200
+```
+
+**Model and runtime controls:**
+```bash
+acfm agents model list
+acfm agents model choose
+acfm agents runtime get
+acfm agents runtime install-zellij
+```
+
+**Artifacts to inspect:**
+- `~/.acfm/synapsegrid/<sessionId>/meeting-log.md`
+- `~/.acfm/synapsegrid/<sessionId>/meeting-summary.md`
+- `~/.acfm/synapsegrid/<sessionId>/turns/raw/*.ndjson`
+
+**Lite rule:** delegate only when collaboration adds value; otherwise continue with normal `ac-lite` flow.
+
+
 ## Conditional Skills (Load Only If Gate Triggers)
 
 ### Security Gate
@@ -74,6 +125,8 @@ Load `secure-coding-cybersecurity` if the change touches any of:
 - Secrets/tokens/credentials
 - Shell/command execution
 
+- Run `vibe-security` as the final security audit before archive (mandatory in Gate B).
+
 ### Testing Gate
 
 Load `test-generator` if:
@@ -140,7 +193,8 @@ If any item fails: stop, resolve, then continue.
 Before `openspec-archive-change`, all must be true:
 
 - `openspec-verify-change` completed
-- No CRITICAL findings remain
+- `vibe-security` executed as final security validation
+- No unresolved CRITICAL/HIGH findings remain
 - Relevant tests pass for changed behavior
 - Tasks are complete or explicitly accepted by user with warning
 - Relevant reusable context from the completed work was saved to memory
@@ -161,8 +215,9 @@ If any item fails: stop, fix, re-verify.
 6. Pass Gate A.
 7. Implement with `openspec-apply-change`.
 8. Verify with `openspec-verify-change`.
-9. Pass Gate B.
-10. Archive with `openspec-archive-change`.
+9. Run `vibe-security` for final security audit and remediate findings.
+10. Pass Gate B.
+11. Archive with `openspec-archive-change`.
 
 ### Existing Change (Default Path)
 
@@ -174,8 +229,9 @@ If any item fails: stop, fix, re-verify.
 6. Pass Gate A.
 7. Implement.
 8. Verify.
-9. Pass Gate B.
-10. Archive.
+9. Run `vibe-security` for final security audit and remediate findings.
+10. Pass Gate B.
+11. Archive.
 
 ---
 

package/framework/web_development/.clinerules/workflows/ac.md

@@ -15,6 +15,7 @@ If you attempt to proceed without completing a required step, you MUST STOP and
 | Skill | Description | Primary Use | Required Before |
 |-------|-------------|-------------|-----------------|
 | `secure-coding-cybersecurity` | Detects and prevents security vulnerabilities (SQLi, XSS, command injection, hardcoded secrets). Follows OWASP Top 10 standards. | Secure code validation | `code-maintainability` |
+| `vibe-security` | Final security audit focused on AI-generated/vibe-coded risks (exposed keys, broken access control, auth/payment/data validation gaps). | Final security validation before closure | `openspec-archive-change` |
 | `code-maintainability` | Analyzes code maintainability: duplication, documentation, error handling, naming conventions, SOLID architecture, performance. | Refactoring and standards | `project-constitution` |
 | `error-handling-patterns` | Error handling patterns in multiple languages: exceptions, Result types, retry, circuit breaker, graceful degradation. | Application resilience | `secure-coding-cybersecurity` |
 | `performance-optimizer` | Methodologies for measuring, profiling, and optimizing code (caching, algorithm complexity, resource usage). | Performance Engineering | After Implementation |
@@ -102,41 +103,74 @@ acfm memory stats
 
 If SynapseGrid is enabled in `acfm init`, AC Framework installs the collaborative MCP server automatically for detected assistants.
 
-**Session-start requirement when collaboration is enabled:**
-1. Prefer the available SynapseGrid MCP tools for collaborative session control before falling back to direct CLI.
-2. Use shared session state and transcript as the source of truth for role-by-role collaboration.
-3. If collaborative MCP is unavailable, use CLI fallback commands and keep behavior equivalent.
+**When to delegate to SynapseGrid:**
+- Multi-step features with architecture + implementation + review work
+- Tasks requiring critical analysis before coding (security, API contracts, refactors)
+- Long-running work where transcript, artifacts, and resumability are important
+- Situations where one assistant would benefit from role-based challenge/review
 
-**How to use SynapseGrid collaboration:**
-```text
-Preferred: use SynapseGrid MCP tools (ac-framework-collab) for start/status/step/resume/stop.
-Fallback: use AC Framework agents CLI commands directly.
-```
-```bash
-# Install/update collaborative MCP server integrations
-acfm agents install-mcps
+**Role delegation model (what each agent does best):**
+- `planner`: breaks down scope, constraints, approach, acceptance criteria
+- `critic`: challenges assumptions, finds risks/blind spots, proposes safer alternatives
+- `coder`: implements code and applies concrete changes
+- `reviewer`: validates quality, consistency with spec/tasks, and production readiness
 
-# Start collaborative runtime with visible 4-pane tmux war-room
-acfm agents start --task "design and implement feature X" --attach --model-coder provider/model
+**Session-start requirement when collaboration is enabled:**
+1. Prefer SynapseGrid MCP tools for start/wait/result/cancel/status flows.
+2. Use transcript + meeting summary + artifacts as source of truth.
+3. If collaborative MCP is unavailable, use equivalent CLI commands.
+
+**Preferred MCP flow (recommended):**
+1. `collab_start_session`
+2. `collab_invoke_team`
+3. `collab_wait_run`
+4. `collab_get_result`
+5. Optional diagnostics: `collab_get_transcript`, `collab_get_meeting_log`, `collab_status`
+
+**CLI fallback and operations:**
+```bash
+# Setup/runtime
+acfm agents setup
+acfm agents runtime install-zellij
+acfm agents runtime set auto
+acfm agents doctor --verbose
 
-# If already running in background, attach to panes and inspect logs
+# Start/run
+acfm agents start --task "design and implement feature X" --mux auto
 acfm agents live
-acfm agents logs --role all --lines 120
+acfm agents status
 
-# Resume/list/export operations
-acfm agents resume
-acfm agents list
+# Visibility and artifacts
+acfm agents transcript --role all --limit 80
+acfm agents summary
+acfm agents artifacts --watch --interval 1200
 acfm agents export --format md --out synapse-session.md
 
-# Fast diagnostics for OpenCode resolution errors
-acfm agents setup
+# Model management
+acfm agents model list
+acfm agents model choose
+acfm agents model set --role coder provider/model
+
+# Lifecycle
+acfm agents resume
+acfm agents stop
 ```
 
-**Troubleshooting notes:**
-- If transcript shows `Agent failed: spawn opencode ENOENT`, run `acfm agents setup` and restart/resume session.
-- If session exists but panes are not visible, use `acfm agents live` (or `acfm agents attach`) or `tmux attach -t <session-name>`.
-- For MCP-first flows, ensure session start enables worker spawning so tmux panes are created.
-- Per-role models can be set at start (`--model-planner`, `--model-critic`, `--model-coder`, `--model-reviewer`) or persisted via `acfm agents model set`.
+**Collaboration artifacts (deterministic, not prompt-dependent):**
+- `~/.acfm/synapsegrid/<sessionId>/transcript.jsonl`
+- `~/.acfm/synapsegrid/<sessionId>/meeting-log.md`
+- `~/.acfm/synapsegrid/<sessionId>/meeting-summary.md`
+- `~/.acfm/synapsegrid/<sessionId>/turns/*.json`
+- `~/.acfm/synapsegrid/<sessionId>/turns/raw/*.ndjson`
+- `~/.acfm/synapsegrid/<sessionId>/turns/raw/*.stderr.log`
+- `~/.acfm/synapsegrid/<sessionId>/diagnostics.json`
+
+**Troubleshooting and robust behavior:**
+- Use `acfm agents doctor --verbose` for capability probe diagnostics.
+- In `--mux auto`, runtime prefers zellij and falls back to tmux when zellij startup fails.
+- If model/provider errors appear, validate with `opencode auth list` and `opencode models`.
+- If workers are running but unclear, inspect `logs`, `transcript`, and `artifacts` before restarting.
+
 
 ### OpenSpec Skills (The heart of the framework)
 
@@ -208,7 +242,7 @@ Before proceeding to next phase, verify you have these outputs:
 | Phase 2 | project-index.md exists, exploration notes | [ ] |
 | Phase 3 | proposal.md, specs/, design.md, tasks.md | [ ] |
 | Phase 4 | Tests written, code implemented, tasks marked complete | [ ] |
-| Phase 5 | Verification passed, docs updated, change archived | [ ] |
+| Phase 5 | Verification passed, `vibe-security` audit complete, docs updated, change archived | [ ] |
 
 **Rule 4: Pre-Implementation Safety Check**
 Before `openspec-apply-change`, ALL must be TRUE:
@@ -370,15 +404,17 @@ When starting a project **from scratch**, follow this **MANDATORY** workflow:
     ║      └─ Resolve any issues                   ║
     ║  26. openspec-verify-change                  ║
     ║      └─ Validate against specs               ║
-    ║  27. documentation                           ║
+    ║  27. vibe-security                           ║
+    ║      └─ Final security audit before closure  ║
+    ║  28. documentation                           ║
     ║      └─ Generate technical docs & diagrams   ║
-    ║  28. sync-index                              ║
+    ║  29. sync-index                              ║
     ║      └─ Update project documentation         ║
-    ║  29. changelog-generator                     ║
+    ║  30. changelog-generator                     ║
     ║      └─ Generate release notes               ║
-    ║  30. ci-deploy                               ║
+    ║  31. ci-deploy                               ║
     ║      └─ Deploy and verify solution           ║
-    ║  31. openspec-archive-change                 ║
+    ║  32. openspec-archive-change                 ║
     ║      └─ Archive the change                   ║
     ╚══════════════════════════════════════════════╝
 ```
@@ -496,15 +532,17 @@ When working on an **existing codebase** (adding features, fixing bugs, refactor
     ║      └─ Fix regressions                      ║
     ║  23. openspec-verify-change                  ║
     ║      └─ Final verification                   ║
-    ║  24. documentation                           ║
+    ║  24. vibe-security                           ║
+    ║      └─ Final security audit before closure  ║
+    ║  25. documentation                           ║
     ║      └─ Generate technical docs & diagrams   ║
-    ║  25. sync-index (IMPORTANT)                  ║
+    ║  26. sync-index (IMPORTANT)                  ║
     ║      └─ Update docs with new changes         ║
-    ║  26. changelog-generator                     ║
+    ║  27. changelog-generator                     ║
     ║      └─ Generate release notes               ║
-    ║  27. ci-deploy                               ║
+    ║  28. ci-deploy                               ║
     ║      └─ Deploy and verify solution           ║
-    ║  28. openspec-archive-change                 ║
+    ║  29. openspec-archive-change                 ║
     ║      └─ Archive change                       ║
     ╚══════════════════════════════════════════════╝
 ```

package/framework/web_development/.codebuddy/commands/opsx/ac-lite.md

@@ -61,6 +61,57 @@ acfm memory stats
 
 ---
 
+
+## SynapseGrid Collaboration Protocol (Optional but Recommended for Complex Tasks)
+
+Use SynapseGrid when a task benefits from role-based collaboration and explicit review loops.
+
+**Delegate to SynapseGrid when:**
+- Scope spans planning + implementation + review
+- Risk is medium/high (security, migrations, API contract changes)
+- You need auditable outputs (transcript, meeting summary, artifacts)
+- A single-pass implementation is likely to miss edge cases
+
+**Role delegation map:**
+- `planner` -> plan/constraints/acceptance criteria
+- `critic` -> risk analysis and challenge assumptions
+- `coder` -> implementation and concrete edits
+- `reviewer` -> final verification and readiness checks
+
+**Preferred MCP flow:**
+1. `collab_start_session`
+2. `collab_invoke_team`
+3. `collab_wait_run`
+4. `collab_get_result`
+5. Optional: `collab_get_transcript`, `collab_get_meeting_log`, `collab_status`
+
+**CLI fallback:**
+```bash
+acfm agents setup
+acfm agents runtime set auto
+acfm agents doctor --verbose
+acfm agents start --task "..." --mux auto
+acfm agents transcript --role all --limit 80
+acfm agents summary
+acfm agents artifacts --watch --interval 1200
+```
+
+**Model and runtime controls:**
+```bash
+acfm agents model list
+acfm agents model choose
+acfm agents runtime get
+acfm agents runtime install-zellij
+```
+
+**Artifacts to inspect:**
+- `~/.acfm/synapsegrid/<sessionId>/meeting-log.md`
+- `~/.acfm/synapsegrid/<sessionId>/meeting-summary.md`
+- `~/.acfm/synapsegrid/<sessionId>/turns/raw/*.ndjson`
+
+**Lite rule:** delegate only when collaboration adds value; otherwise continue with normal `ac-lite` flow.
+
+
 ## Conditional Skills (Load Only If Gate Triggers)
 
 ### Security Gate
@@ -74,6 +125,8 @@ Load `secure-coding-cybersecurity` if the change touches any of:
 - Secrets/tokens/credentials
 - Shell/command execution
 
+- Run `vibe-security` as the final security audit before archive (mandatory in Gate B).
+
 ### Testing Gate
 
 Load `test-generator` if:
@@ -140,7 +193,8 @@ If any item fails: stop, resolve, then continue.
 Before `openspec-archive-change`, all must be true:
 
 - `openspec-verify-change` completed
-- No CRITICAL findings remain
+- `vibe-security` executed as final security validation
+- No unresolved CRITICAL/HIGH findings remain
 - Relevant tests pass for changed behavior
 - Tasks are complete or explicitly accepted by user with warning
 - Relevant reusable context from the completed work was saved to memory
@@ -161,8 +215,9 @@ If any item fails: stop, fix, re-verify.
 6. Pass Gate A.
 7. Implement with `openspec-apply-change`.
 8. Verify with `openspec-verify-change`.
-9. Pass Gate B.
-10. Archive with `openspec-archive-change`.
+9. Run `vibe-security` for final security audit and remediate findings.
+10. Pass Gate B.
+11. Archive with `openspec-archive-change`.
 
 ### Existing Change (Default Path)
 
@@ -174,8 +229,9 @@ If any item fails: stop, fix, re-verify.
 6. Pass Gate A.
 7. Implement.
 8. Verify.
-9. Pass Gate B.
-10. Archive.
+9. Run `vibe-security` for final security audit and remediate findings.
+10. Pass Gate B.
+11. Archive.
 
 ---
 

package/framework/web_development/.codebuddy/commands/opsx/ac.md

@@ -15,6 +15,7 @@ If you attempt to proceed without completing a required step, you MUST STOP and
 | Skill | Description | Primary Use | Required Before |
 |-------|-------------|-------------|-----------------|
 | `secure-coding-cybersecurity` | Detects and prevents security vulnerabilities (SQLi, XSS, command injection, hardcoded secrets). Follows OWASP Top 10 standards. | Secure code validation | `code-maintainability` |
+| `vibe-security` | Final security audit focused on AI-generated/vibe-coded risks (exposed keys, broken access control, auth/payment/data validation gaps). | Final security validation before closure | `openspec-archive-change` |
 | `code-maintainability` | Analyzes code maintainability: duplication, documentation, error handling, naming conventions, SOLID architecture, performance. | Refactoring and standards | `project-constitution` |
 | `error-handling-patterns` | Error handling patterns in multiple languages: exceptions, Result types, retry, circuit breaker, graceful degradation. | Application resilience | `secure-coding-cybersecurity` |
 | `performance-optimizer` | Methodologies for measuring, profiling, and optimizing code (caching, algorithm complexity, resource usage). | Performance Engineering | After Implementation |
@@ -102,41 +103,74 @@ acfm memory stats
 
 If SynapseGrid is enabled in `acfm init`, AC Framework installs the collaborative MCP server automatically for detected assistants.
 
-**Session-start requirement when collaboration is enabled:**
-1. Prefer the available SynapseGrid MCP tools for collaborative session control before falling back to direct CLI.
-2. Use shared session state and transcript as the source of truth for role-by-role collaboration.
-3. If collaborative MCP is unavailable, use CLI fallback commands and keep behavior equivalent.
+**When to delegate to SynapseGrid:**
+- Multi-step features with architecture + implementation + review work
+- Tasks requiring critical analysis before coding (security, API contracts, refactors)
+- Long-running work where transcript, artifacts, and resumability are important
+- Situations where one assistant would benefit from role-based challenge/review
 
-**How to use SynapseGrid collaboration:**
-```text
-Preferred: use SynapseGrid MCP tools (ac-framework-collab) for start/status/step/resume/stop.
-Fallback: use AC Framework agents CLI commands directly.
-```
-```bash
-# Install/update collaborative MCP server integrations
-acfm agents install-mcps
+**Role delegation model (what each agent does best):**
+- `planner`: breaks down scope, constraints, approach, acceptance criteria
+- `critic`: challenges assumptions, finds risks/blind spots, proposes safer alternatives
+- `coder`: implements code and applies concrete changes
+- `reviewer`: validates quality, consistency with spec/tasks, and production readiness
 
-# Start collaborative runtime with visible 4-pane tmux war-room
-acfm agents start --task "design and implement feature X" --attach --model-coder provider/model
+**Session-start requirement when collaboration is enabled:**
+1. Prefer SynapseGrid MCP tools for start/wait/result/cancel/status flows.
+2. Use transcript + meeting summary + artifacts as source of truth.
+3. If collaborative MCP is unavailable, use equivalent CLI commands.
+
+**Preferred MCP flow (recommended):**
+1. `collab_start_session`
+2. `collab_invoke_team`
+3. `collab_wait_run`
+4. `collab_get_result`
+5. Optional diagnostics: `collab_get_transcript`, `collab_get_meeting_log`, `collab_status`
+
+**CLI fallback and operations:**
+```bash
+# Setup/runtime
+acfm agents setup
+acfm agents runtime install-zellij
+acfm agents runtime set auto
+acfm agents doctor --verbose
 
-# If already running in background, attach to panes and inspect logs
+# Start/run
+acfm agents start --task "design and implement feature X" --mux auto
 acfm agents live
-acfm agents logs --role all --lines 120
+acfm agents status
 
-# Resume/list/export operations
-acfm agents resume
-acfm agents list
+# Visibility and artifacts
+acfm agents transcript --role all --limit 80
+acfm agents summary
+acfm agents artifacts --watch --interval 1200
 acfm agents export --format md --out synapse-session.md
 
-# Fast diagnostics for OpenCode resolution errors
-acfm agents setup
+# Model management
+acfm agents model list
+acfm agents model choose
+acfm agents model set --role coder provider/model
+
+# Lifecycle
+acfm agents resume
+acfm agents stop
 ```
 
-**Troubleshooting notes:**
-- If transcript shows `Agent failed: spawn opencode ENOENT`, run `acfm agents setup` and restart/resume session.
-- If session exists but panes are not visible, use `acfm agents live` (or `acfm agents attach`) or `tmux attach -t <session-name>`.
-- For MCP-first flows, ensure session start enables worker spawning so tmux panes are created.
-- Per-role models can be set at start (`--model-planner`, `--model-critic`, `--model-coder`, `--model-reviewer`) or persisted via `acfm agents model set`.
+**Collaboration artifacts (deterministic, not prompt-dependent):**
+- `~/.acfm/synapsegrid/<sessionId>/transcript.jsonl`
+- `~/.acfm/synapsegrid/<sessionId>/meeting-log.md`
+- `~/.acfm/synapsegrid/<sessionId>/meeting-summary.md`
+- `~/.acfm/synapsegrid/<sessionId>/turns/*.json`
+- `~/.acfm/synapsegrid/<sessionId>/turns/raw/*.ndjson`
+- `~/.acfm/synapsegrid/<sessionId>/turns/raw/*.stderr.log`
+- `~/.acfm/synapsegrid/<sessionId>/diagnostics.json`
+
+**Troubleshooting and robust behavior:**
+- Use `acfm agents doctor --verbose` for capability probe diagnostics.
+- In `--mux auto`, runtime prefers zellij and falls back to tmux when zellij startup fails.
+- If model/provider errors appear, validate with `opencode auth list` and `opencode models`.
+- If workers are running but unclear, inspect `logs`, `transcript`, and `artifacts` before restarting.
+
 
 ### OpenSpec Skills (The heart of the framework)
 
@@ -208,7 +242,7 @@ Before proceeding to next phase, verify you have these outputs:
 | Phase 2 | project-index.md exists, exploration notes | [ ] |
 | Phase 3 | proposal.md, specs/, design.md, tasks.md | [ ] |
 | Phase 4 | Tests written, code implemented, tasks marked complete | [ ] |
-| Phase 5 | Verification passed, docs updated, change archived | [ ] |
+| Phase 5 | Verification passed, `vibe-security` audit complete, docs updated, change archived | [ ] |
 
 **Rule 4: Pre-Implementation Safety Check**
 Before `openspec-apply-change`, ALL must be TRUE:
@@ -370,15 +404,17 @@ When starting a project **from scratch**, follow this **MANDATORY** workflow:
     ║      └─ Resolve any issues                   ║
     ║  26. openspec-verify-change                  ║
     ║      └─ Validate against specs               ║
-    ║  27. documentation                           ║
+    ║  27. vibe-security                           ║
+    ║      └─ Final security audit before closure  ║
+    ║  28. documentation                           ║
     ║      └─ Generate technical docs & diagrams   ║
-    ║  28. sync-index                              ║
+    ║  29. sync-index                              ║
     ║      └─ Update project documentation         ║
-    ║  29. changelog-generator                     ║
+    ║  30. changelog-generator                     ║
     ║      └─ Generate release notes               ║
-    ║  30. ci-deploy                               ║
+    ║  31. ci-deploy                               ║
     ║      └─ Deploy and verify solution           ║
-    ║  31. openspec-archive-change                 ║
+    ║  32. openspec-archive-change                 ║
     ║      └─ Archive the change                   ║
     ╚══════════════════════════════════════════════╝
 ```
@@ -496,15 +532,17 @@ When working on an **existing codebase** (adding features, fixing bugs, refactor
     ║      └─ Fix regressions                      ║
     ║  23. openspec-verify-change                  ║
     ║      └─ Final verification                   ║
-    ║  24. documentation                           ║
+    ║  24. vibe-security                           ║
+    ║      └─ Final security audit before closure  ║
+    ║  25. documentation                           ║
     ║      └─ Generate technical docs & diagrams   ║
-    ║  25. sync-index (IMPORTANT)                  ║
+    ║  26. sync-index (IMPORTANT)                  ║
     ║      └─ Update docs with new changes         ║
-    ║  26. changelog-generator                     ║
+    ║  27. changelog-generator                     ║
     ║      └─ Generate release notes               ║
-    ║  27. ci-deploy                               ║
+    ║  28. ci-deploy                               ║
     ║      └─ Deploy and verify solution           ║
-    ║  28. openspec-archive-change                 ║
+    ║  29. openspec-archive-change                 ║
     ║      └─ Archive change                       ║
     ╚══════════════════════════════════════════════╝
 ```

package/framework/web_development/.codebuddy/skills/sync-index/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: sync-index
-description: Keep project documentation (.agents/project-index.md and sub-skills) in sync with codebase changes.
+description: Keep project documentation (.agentss/project-index.md and sub-skills) in sync with codebase changes.
 ---
 
 # Documentation Sync

package/framework/web_development/.codebuddy/skills/vibe-security/SKILL.md

@@ -0,0 +1,122 @@
+---
+name: vibe-security
+description: Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".
+license: MIT
+metadata:
+  author: Chris Raroque
+  version: "1.0"
+---
+
+Audit code for security vulnerabilities commonly introduced by AI code generation. These issues are prevalent in "vibe-coded" apps — projects built rapidly with AI assistance where security fundamentals get skipped.
+
+AI assistants consistently get these patterns wrong, leading to real breaches, stolen API keys, and drained billing accounts. This skill exists to catch those mistakes before they ship.
+
+
+## The Core Principle
+
+Never trust the client. Every price, user ID, role, subscription status, feature flag, and rate limit counter must be validated or enforced server-side. If it exists only in the browser, mobile bundle, or request body, an attacker controls it.
+
+
+## Audit Process
+
+Examine the codebase systematically. For each step, load the relevant reference file only if the codebase uses that technology or pattern. Skip steps that aren't relevant.
+
+1. **Secrets & Environment Variables** — Scan for hardcoded API keys, tokens, or credentials. Check for secrets exposed via client-side env var prefixes (`NEXT_PUBLIC_`, `VITE_`, `EXPO_PUBLIC_`). Verify `.env` is in `.gitignore`. See `references/secrets-and-env.md`.
+
+2. **Database Access Control** — Check Supabase RLS policies, Firebase Security Rules, or Convex auth guards. This is the #1 source of critical vulnerabilities in vibe-coded apps. See `references/database-security.md`.
+
+3. **Authentication & Authorization** — Validate JWT handling, middleware auth, Server Action protection, and session management. See `references/authentication.md`.
+
+4. **Rate Limiting & Abuse Prevention** — Ensure auth endpoints, AI calls, and expensive operations have rate limits. Verify rate limit counters can't be tampered with. See `references/rate-limiting.md`.
+
+5. **Payment Security** — Check for client-side price manipulation, webhook signature verification, and subscription status validation. See `references/payments.md`.
+
+6. **Mobile Security** — Verify secure token storage, API key protection via backend proxy, and deep link validation. See `references/mobile.md`.
+
+7. **AI / LLM Integration** — Check for exposed AI API keys, missing usage caps, prompt injection vectors, and unsafe output rendering. See `references/ai-integration.md`.
+
+8. **Deployment Configuration** — Verify production settings, security headers, source map exposure, and environment separation. See `references/deployment.md`.
+
+9. **Data Access & Input Validation** — Check for SQL injection, ORM misuse, and missing input validation. See `references/data-access.md`.
+
+If doing a partial review or generating code in a specific area, load only the relevant reference files.
+
+
+## Core Instructions
+
+- Report only genuine security issues. Do not nitpick style or non-security concerns.
+- When multiple issues exist, prioritize by exploitability and real-world impact.
+- If the codebase doesn't use a particular technology (e.g., no Supabase), skip that section entirely.
+- When generating new code, consult the relevant reference files proactively to avoid introducing vulnerabilities in the first place.
+- If you find a critical issue (exposed secrets, disabled RLS, auth bypass), flag it immediately at the top of your response — don't bury it in a long list.
+
+
+## Output Format
+
+Organize findings by severity: **Critical** → **High** → **Medium** → **Low**.
+
+For each issue:
+1. State the file and relevant line(s).
+2. Name the vulnerability.
+3. Explain what an attacker could do (concrete impact, not abstract risk).
+4. Show a before/after code fix.
+
+Skip areas with no issues. End with a prioritized summary.
+
+### Example Output
+
+#### Critical
+
+**`lib/supabase.ts:3` — Supabase `service_role` key exposed in client bundle**
+
+The `service_role` key bypasses all Row-Level Security. Anyone can extract it from the browser bundle and read, modify, or delete every row in your database.
+
+```typescript
+// Before
+const supabase = createClient(url, process.env.NEXT_PUBLIC_SUPABASE_SERVICE_KEY!)
+
+// After — use the anon key client-side; service_role belongs only in server-side code
+const supabase = createClient(url, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!)
+```
+
+#### High
+
+**`app/api/checkout/route.ts:15` — Price taken from client request body**
+
+An attacker can set any price (including $0.01) by modifying the request. Prices must be looked up server-side.
+
+```typescript
+// Before
+const session = await stripe.checkout.sessions.create({
+  line_items: [{ price_data: { unit_amount: req.body.price } }]
+})
+
+// After — look up the price server-side
+const product = await db.products.findUnique({ where: { id: req.body.productId } })
+const session = await stripe.checkout.sessions.create({
+  line_items: [{ price: product.stripePriceId }]
+})
+```
+
+### Summary
+
+1. **Service role key exposed (Critical):** Anyone can bypass all database security. Rotate the key immediately and move it to server-side only.
+2. **Client-controlled pricing (High):** Attackers can purchase at any price. Use server-side price lookup.
+
+
+## When Generating Code
+
+These rules also apply proactively. Before writing code that touches auth, payments, database access, API keys, or user data, consult the relevant reference file to avoid introducing the vulnerability in the first place. Prevention is better than detection.
+
+
+## References
+
+- `references/secrets-and-env.md` — API keys, tokens, environment variable configuration, and `.gitignore` rules.
+- `references/database-security.md` — Supabase RLS, Firebase Security Rules, and Convex auth patterns.
+- `references/authentication.md` — JWT verification, middleware, Server Actions, and session management.
+- `references/rate-limiting.md` — Rate limiting strategies and abuse prevention.
+- `references/payments.md` — Stripe security, webhook verification, and price validation.
+- `references/mobile.md` — React Native and Expo security: secure storage, API proxy, deep links.
+- `references/ai-integration.md` — LLM API key protection, usage caps, prompt injection, and output sanitization.
+- `references/deployment.md` — Production configuration, security headers, and environment separation.
+- `references/data-access.md` — SQL injection prevention, ORM safety, and input validation.