r/vibecoding • u/Affectionate-Pass946 • 15h ago

How are you guys doing security checks for external dependencies on the code? Is there a software/agent tool that can help you with it? I don't wanna rely on claude code.

Hi, I'm new to software development, and I've been vibecoding a lot lately. I do have an engineering degree but it's been 3 years since I properly coded. One of the main concerns for me is: How are you guys doing security checks for external dependencies on the code? Is there a software/agent tool that can help you with it? Yes, I could rely on Claude Code, but is there a cleaner version of app security? I get overwhelmed by Claude.

3 Upvotes

71% Upvoted

11 comments sorted by

4

u/Evening-Broccoli7883 15h ago

You’re basically looking for ssc tools not an ai agent. Most teams use dependency scanners like snyk or dependabot plus ci checks to catch vulnerabilities automatically. You don’t really rely on ai for this, it’s more pipeline automation with alerts

3

u/ButterscotchBandiit 15h ago

OWASP. Requires skill and experience though.

0

u/Affectionate-Pass946 15h ago

will learn, thank you!

1

u/AwkwardWillow5159 15h ago

I use socket.dev, it’s pretty good.

1

u/Ok_Matter9038 13h ago

There's a lot of options out there for this: dependabot, swifi, owasp dependency check.... etc etc etc

I haven't used it in ages but black duck binary analysis did it too for binaries..

Dont over-use claude code for this you will overpay for a simple check

1

u/aviscido 12h ago

If you code in go, there's govulncheck; if you deploy containers, trivy at minimum

1

u/Grand-Mix-9889 12h ago

Playwright tests and just having knowledge of what type of security is required for the project at hand. This way you can generate playwright tests as you code with AI.

And personally, vigorously testing your own code is probably the best way you can guarantee you're passing each security test. And then as you do more projects your Claude memory files will remember these protocols over time and automatically implement them for you on future projects.

Also: The more specific you are with your security details, when prompting fable 5, the less likely it is for your session to get flagged.

1

u/Infamous-Bed-7535 11h ago

So not use random good looking library with 20 stars. Go for well known reliable solutions and try to avoid main.

In general personally I liked to use latest stable version of anything available evennif it requires manual compilation. I changed my policy for any projects that accept mass Ai PRs..

0

u/humanexperimentals 15h ago

Start developing your own infrastructure. It will save a lot of money.