While building with AI agents, I realized the biggest problem wasn’t getting code generated — it was trusting code that looked fine and worked.

In one case, I shipped code that exposed a secret. After reviewing more AI-written code, I kept finding the same pattern: things that worked, but introduced security risks quietly.

So I started building a tool for myself that scans generated code before it gets written to files.

This screenshot shows two examples it caught:

* hard-coded secret
* credentials passed in URL params

What I’m experimenting with is moving security checks earlier into the vibe coding loop instead of waiting until later review.

**How I built it:**

* MCP-based workflow so it can sit in the agent loop
* scans generated code before write
* pattern-based detection for common risky code
* fix hints shown immediately in the scan results

**What I learned building it:**

* “working code” is not the same as safe code
* prompts alone are not enough guardrails
* once AI speeds up code generation, review becomes the bottleneck

I’m still improving it, but I’d love feedback from people here:  
What security issues have you actually seen from AI-generated code in your workflow?

Built a guardrail for vibe coding after AI slipped a hardcoded secret into my app