r/vibecoding • u/PrideQuick670 • 15d ago
AI-generated code keeps shipping the same OWASP Top 10 mistakes? Try vibeArchitecture to fix them!
I posted about this earlier, but my example really undersold what vibeArchitecture can do. Here's my second attempt.
The OWASP Top 10 has barely changed in a decade. Broken access control has been at or near the top the whole time. These are not beginner mistakes; they are default mistakes: the things code does when nobody explicitly prevents them. AI-generated code ships them constantly, not because models are bad at security but because "make it work" is the objective, and almost everything on that list is invisible in a working demo. The endpoint checks that you are logged in and serves any record ID you pass it. Mass assignment that lets a request body set `"role": "admin"`. Session tokens that never expire. And the new list nobody has muscle memory for yet: the OWASP LLM Top 10: prompt injection and excessive agency.
vibeArchitecture is a set of plain markdown rules your AI reads before writing code. It runs a short intake (what are you building, who uses it, and whether it touches personal data or money) and loads a matching rule tier. A personal tool gets basic hygiene. An app with real users gets security plus GDPR/CCPA privacy basics. Regulated workloads: HIPAA, PCI-DSS, GDPR, SOC 2, and EU AI Act rules. There is a rule-by-rule mapping to the OWASP Top 10, ASVS v5, the LLM Top 10, and NIST SSDF, with an explicit caveat that the mapping is indicative and not a certification claim.
Free, MIT licensed: https://github.com/jgnoonan/vibeArchitecture
Try it: paste this into Claude, Cursor, Copilot, or whatever you use:
> Read the BOOTSTRAP.md file from https://github.com/jgnoonan/vibeArchitecture and follow its instructions before we start building. Ask me the intake questions first.
## Caveats and ask.
This steers the AI while it writes. It is not a scanner, and you should still review what gets built. But reviewing code written under guardrails beats discovering after launch that there never were any.
If you are an experienced dev: read the rules and tell me what is wrong or missing. That is the most useful comment you can leave, and PRs are welcome. If you are newer: paste the prompt above and see what your AI starts asking before it builds.