A security checklist for vibe coding.

Give the agent only the repository and tools needed for the task. Keep secrets out of prompts and committed instructions. Review permission settings before allowing commands that install dependencies, access credentials, or make network or production changes.

Inspect security boundaries in the changed code, not just the feature's happy path. Ask how a user controls the data, what permissions are checked, and how invalid or hostile input is handled.

Run relevant tests and inspect the full diff after generated edits settle. Review dependency and secret-scan findings. If a security check did not run, record that limitation and choose a manual review or another check before release.

ProofCheck can report selected dependency CVEs, exposed secrets, and unsafe patterns in changed code. Its findings are evidence to investigate, not a security score; a clean result does not prove software is free of vulnerabilities.

Security depends on the product's threat model and surrounding system. Keep someone responsible for reviewing the generated changes, deciding whether evidence is sufficient, and approving deployment. No prompt, agent, or scanner can make that decision on your behalf.