The latest articles on DEV Community by VibeFoundry (@avivgerzhue). https://dev.to/avivgerzhue https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4234054%2Fd164f5b5-2e54-4969-b214-26a20b6910d6.png https://dev.to/avivgerzhue en VibeFoundry Mon, 09 Nov 2026 22:48:27 +0000 https://dev.to/avivgerzhue/before-you-push-ai-generated-code-to-prod-run-these-3-open-source-tools-jnl https://dev.to/avivgerzhue/before-you-push-ai-generated-code-to-prod-run-these-3-open-source-tools-jnl <p><strong>🎨 UI DNA:</strong> npx -y unslop-mcp@latest init</p> <p><strong>🛡️ Security Audit:</strong> npx -y @vibefoundry/vibe-shield@latest scan .</p> <p><strong>👻 Browser QA:</strong> npx -y ghost-qa@latest init</p> <p>Link for my Profile:<br> </p> <div class="crayons-card c-embed text-styles text-styles--secondary"> <div class="c-embed__content"> <div class="c-embed__cover"> <a href="https://github.com/avivgerz-hue" class="c-link align-middle" rel="noopener noreferrer"> <img alt="" src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Favatars.githubusercontent.com%2Fu%2F234205358%3Fv%3D4%3Fs%3D400" height="420" class="m-0" width="420"> </a> </div> <div class="c-embed__body"> <h2 class="fs-xl lh-tight"> <a href="https://github.com/avivgerz-hue" rel="noopener noreferrer" class="c-link"> avivgerz-hue (VibeFoundry) · GitHub </a> </h2> <p class="truncate-at-3"> avivgerz-hue has 9 repositories available. Follow their code on GitHub. </p> <div class="color-secondary fs-s flex items-center"> <img alt="favicon" class="c-embed__favicon m-0 mr-2 radius-0" src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fgithub.githubassets.com%2Ffavicons%2Ffavicon.svg" width="32" height="32"> github.com </div> </div> </div> </div> ai webdev opensource security VibeFoundry Sun, 08 Nov 2026 20:15:49 +0000 https://dev.to/avivgerzhue/i-scanned-8-newly-shipped-nextjs-supabase-ai-repos-on-github-5-scored-an-f-288-security-51m0 https://dev.to/avivgerzhue/i-scanned-8-newly-shipped-nextjs-supabase-ai-repos-on-github-5-scored-an-f-288-security-51m0 <p>Today I ran a security scanner across 8 recently updated <strong>Next.js + Supabase + OpenAI</strong> repositories on GitHub.</p> <h3> The Results: </h3> <ul> <li> <strong>6 out of 8 repos (75%)</strong> had real security vulnerabilities.</li> <li><strong>5 out of 8 scored a Grade F.</strong></li> <li> <strong>288 total security issues</strong> across just 8 projects.</li> </ul> <h3> The Top 3 Mistakes AI Coding Agents Make: </h3> <ol> <li> <strong>No Row Level Security (RLS):</strong> AI writes <code>CREATE TABLE</code> in Supabase migrations, but forgets <code>ENABLE ROW LEVEL SECURITY</code>—or silences errors with <code>USING (true)</code>. Anyone can dump or wipe the database from Chrome DevTools using <code>NEXT_PUBLIC_SUPABASE_ANON_KEY</code>.</li> <li> <strong>Unprotected API Routes:</strong> AI creates Next.js <code>POST</code> and <code>DELETE</code> routes with zero session check, or trusts <code>userId</code> from <code>req.json()</code> instead of the server session.</li> <li> <strong>Leaked Client Keys:</strong> Putting secret keys into <code>NEXT_PUBLIC_</code> or <code>VITE_</code> variables.</li> </ol> <h3> Test Your Own Repo in 3 Seconds </h3> <p>I built three free, open-source tools for Claude Code and Cursor that run 100% locally on your machine:</p> <h3> 1. Vibe-Shield v2.0 (85-Rule Security Scanner &amp; Attack-Surface Mapper) </h3> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>npx -y @vibefoundry/vibe-shield@latest scan . </code></pre> </div> <div class="ltag-github-readme-tag"> <div class="readme-overview"> <h2> <img src="https://assets.dev.to/assets/github-logo-5a155e1f9a670af7944dd5e12375bc76ed542ea80224905ecaf878b9157cdefc.svg" alt="GitHub logo"> <a href="https://github.com/avivgerz-hue" rel="noopener noreferrer"> avivgerz-hue </a> / <a href="https://github.com/avivgerz-hue/vibe-shield" rel="noopener noreferrer"> vibe-shield </a> </h2> <h3> 60-rule static security scanner, MCP server &amp; skill poisoning auditor for AI-generated codebases (Claude Code, Codex, Cursor). </h3> </div> <div class="ltag-github-body"> <div id="readme" class="md"><div> <div class="markdown-heading"> <h1 class="heading-element">🛡️ vibe-shield</h1> </div> <p><strong>The security gate for AI-written code.</strong></p> <p>Your agent ships fast. It also ships <code>NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY</code>, a <code>DELETE</code> route with no session check, and a <code>CREATE TABLE</code> with no Row Level Security — because it was optimising for "it works".</p> <p>vibe-shield is a <strong>static security scanner built for that failure mode</strong>, plus an <strong>Agent Skill</strong> that makes Claude Code, Codex, Cursor and Windsurf audit before they say <em>"done"</em>.</p> <p><a href="https://www.npmjs.com/package/@vibefoundry/vibe-shield" rel="nofollow noopener noreferrer"><img src="https://camo.githubusercontent.com/0508b98d12fd18881fa813d8cb996f25470235853ef5e4d9dff9bfe4637aff2f/68747470733a2f2f696d672e736869656c64732e696f2f6e706d2f762f4076696265666f756e6472792f766962652d736869656c642e737667" alt="npm version"></a> <a href="https://www.npmjs.com/package/@vibefoundry/vibe-shield" rel="nofollow noopener noreferrer"><img src="https://camo.githubusercontent.com/9ef1b2cf508cfff0b7468d07935fd0f5d841691f3cbe286ded0e5ffacc758266/68747470733a2f2f696d672e736869656c64732e696f2f6e706d2f646d2f4076696265666f756e6472792f766962652d736869656c642e737667" alt="npm downloads"></a> <a href="https://github.com/avivgerz-hue/vibe-shield/actions/workflows/ci.yml" rel="noopener noreferrer"><img src="https://camo.githubusercontent.com/c207b1e3653d90fb5e2e63159578750812922be9e8d8804d0ab2ff5e39cd6bad/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f617669766765727a2d6875652f766962652d736869656c642f63692e796d6c3f6272616e63683d6d61696e267374796c653d666c61742d737175617265266c6f676f3d676974687562616374696f6e73266c6162656c3d4349" alt="CI"></a> <a href="https://github.com/avivgerz-hue/vibe-shield#-requirements" rel="noopener noreferrer"><img src="https://camo.githubusercontent.com/09eac7aec60251d150f8e9a26759d649a539d177466ff63488d959da92b92f64/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6e6f64652d25453225383925413531382e31372e302d3566613034653f7374796c653d666c61742d737175617265266c6f676f3d6e6f6465646f746a73" alt="node"></a> <a href="https://github.com/avivgerz-hue/vibe-shield/./LICENSE" rel="noopener noreferrer"><img src="https://camo.githubusercontent.com/b6cdac3bed3baa1f49545c6c4db4d59a73050f3493342c763062b5f082befafc/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f6c6963656e73652f617669766765727a2d6875652f766962652d736869656c643f7374796c653d666c61742d73717561726526636f6c6f723d626c7565" alt="license"></a> <a href="https://github.com/avivgerz-hue/vibe-shield/./package.json" rel="noopener noreferrer"><img src="https://camo.githubusercontent.com/2c2457b86576a8439f9b6a7cc78760d381b194cb9fd91924c31fed0b6c608e75/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f72756e74696d65253230646570732d302d627269676874677265656e3f7374796c653d666c61742d737175617265" alt="zero dependencies"></a> <a href="https://github.com/avivgerz-hue/vibe-shield/./src/scanner/rules" rel="noopener noreferrer"><img src="https://camo.githubusercontent.com/fa940e6467e29973113995390eb3cb56ca0946f28cf4336ebd0320e9e89dbb84/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f646574656374696f6e2532307369676e6174757265732d39312d3862356366363f7374796c653d666c61742d737175617265" alt="rules"></a> <a href="https://github.com/avivgerz-hue/vibe-shield#-it-scans-itself" rel="noopener noreferrer"><img src="https://camo.githubusercontent.com/967a43617b55ec4d76e2a053fbfbae13c678903ac0b7a6ba961ad90e2b6067a7/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f73656c662d2d7363616e2d313030253246313030253230412532422d3136613334613f7374796c653d666c61742d737175617265" alt="self-scan"></a></p> <div class="highlight highlight-source-shell notranslate position-relative overflow-auto js-code-highlight"> <pre>npx -y @vibefoundry/vibe-shield scan</pre> </div> <p><a rel="noopener noreferrer" href="https://github.com/avivgerz-hue/vibe-shield/./assets/hero-terminal.svg"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fraw.githubusercontent.com%2Favivgerz-hue%2Fvibe-shield%2FHEAD%2F.%2Fassets%2Fhero-terminal.svg" alt="vibe-shield terminal preview"></a></p> </div> <div class="markdown-heading"> <h2 class="heading-element">v2.0.0: eight defensive vectors</h2> </div> <p>The v2 catalogue covers client exposure; auth and route protection; database/RLS; AI and web sinks; infrastructure; dependency hygiene; secrets and cryptography; and agent/MCP integrity. The new hardening checks include production source maps, insecure JWT settings, explicit and omitted cookie flags, locally absent security headers, container users, lifecycle scripts, lockfiles and weak cryptography. Run <code>rules</code> for the complete catalogue.</p> <p>The scanner produces a heuristic <strong>attack-surface inventory</strong> of route methods, observed guard signals…</p></div> </div> <div class="gh-btn-container"><a class="gh-btn" href="https://github.com/avivgerz-hue/vibe-shield" rel="noopener noreferrer">View on GitHub</a></div> </div> <h3> 2. Unslop v2.0 (72-Rule Anti-AI-Slop UI Linter &amp; 10 Design Token Systems) </h3> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>npx -y unslop-mcp@latest audit ./src </code></pre> </div> <div class="ltag-github-readme-tag"> <div class="readme-overview"> <h2> <img src="https://assets.dev.to/assets/github-logo-5a155e1f9a670af7944dd5e12375bc76ed542ea80224905ecaf878b9157cdefc.svg" alt="GitHub logo"> <a href="https://github.com/avivgerz-hue" rel="noopener noreferrer"> avivgerz-hue </a> / <a href="https://github.com/avivgerz-hue/unslop" rel="noopener noreferrer"> unslop </a> </h2> <h3> Studio-grade UI design systems, Design DNA extractor &amp; Anti-Slop MCP server for AI coding agents (Claude Code, Codex, Cursor, Windsurf). </h3> </div> <div class="ltag-github-body"> <div id="readme" class="md"><div class="markdown-heading"> <h1 class="heading-element">unslop v2.0.0</h1> </div> <p><strong>Your agent can write the code. unslop gives it a measurable design engineering protocol.</strong></p> <p><a href="https://www.npmjs.com/package/unslop-mcp" rel="nofollow noopener noreferrer"><img src="https://camo.githubusercontent.com/511016941788636bd1a1cadcc7ab087e0e7ee2f71e6ce058224427b4584237c7/68747470733a2f2f696d672e736869656c64732e696f2f6e706d2f762f756e736c6f702d6d63702e737667" alt="npm version"></a> <a href="https://www.npmjs.com/package/unslop-mcp" rel="nofollow noopener noreferrer"><img src="https://camo.githubusercontent.com/e39eda783d92d855f4809b1d5ad918027ca425c7d62e824d33e3dca31a46e35f/68747470733a2f2f696d672e736869656c64732e696f2f6e706d2f646d2f756e736c6f702d6d63702e737667" alt="npm downloads"></a> <a href="https://github.com/avivgerz-hue/unslop/actions/workflows/ci.yml" rel="noopener noreferrer"><img src="https://github.com/avivgerz-hue/unslop/actions/workflows/ci.yml/badge.svg" alt="CI"></a> <a href="https://nodejs.org/" rel="nofollow noopener noreferrer"><img src="https://camo.githubusercontent.com/eccc84a3ac1662759ff490d15a7521327cf4a4ccfde707da30125ec2355bb2b9/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6e6f64652d25334525334432302e31392d336338373361" alt="Node.js 20.19+"></a> <a href="https://github.com/avivgerz-hue/unslop/LICENSE" rel="noopener noreferrer"><img src="https://camo.githubusercontent.com/69ddf80bd59ce4919aab829d1bdf4c9d774194215cdbe6afd8b173346b511ce3/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6c6963656e73652d4d49542d313131313131" alt="MIT license"></a></p> <p><a rel="noopener noreferrer" href="https://github.com/avivgerz-hue/unslop/./assets/hero-preview.svg"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fraw.githubusercontent.com%2Favivgerz-hue%2Funslop%2FHEAD%2F.%2Fassets%2Fhero-preview.svg" alt="unslop preview"></a></p> <p><code>unslop</code> is a zero-runtime-dependency <strong>UI/UX Design Engineering CLI, native MCP Server, and AI Agent Skill</strong>. It audits 72 rules across seven design craft pillars, installs ten studio-grade archetypes, extracts Design DNA, exports four token formats, and turns every finding into an exact, prioritized transformation blueprint for JSX/TSX, HTML, Vue, Svelte, CSS, and Tailwind codebases.</p> <p>Works with <strong>Claude Code, OpenAI Codex, Cursor, Windsurf, Cline</strong>, and any agent that reads project instructions.</p> <p><a rel="noopener noreferrer nofollow" href="https://raw.githubusercontent.com/avivgerz-hue/unslop/main/docs/assets/before-after-unslop.png"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fraw.githubusercontent.com%2Favivgerz-hue%2Funslop%2Fmain%2Fdocs%2Fassets%2Fbefore-after-unslop.png" alt="Before and after unslop: a generic purple-gradient AI landing page transformed into a precise, token-driven Linear Dark dashboard"></a></p> <div class="highlight highlight-source-shell notranslate position-relative overflow-auto js-code-highlight"> <pre>npx -y unslop-mcp init --preset linear-precision npx -y unslop-mcp audit <span class="pl-c1">.</span> npx -y unslop-mcp refactor-plan <span class="pl-c1">.</span> --report UNSLOP-REPORT.md</pre> </div> <p>The result is not a generic prompt. It is a versioned token contract, a <strong>Design Craft Score from 0–100</strong>, a seven-pillar scorecard, exact before/after translations, and file-level steps your agent can execute in one coherent pass.</p> <div class="markdown-heading"> <h2 class="heading-element">v2 at a glance</h2> </div> <div class="table-wrapper-paragraph"><table> <thead> <tr> <th>Capability</th> <th>v2 contract</th> </tr> </thead> </table></div>…</div> </div> <div class="gh-btn-container"><a class="gh-btn" href="https://github.com/avivgerz-hue/unslop" rel="noopener noreferrer">View on GitHub</a></div> </div> <h3> 3. Ghost-QA v2.0 (8-Trap Headless Browser QA for Desktop &amp; Mobile) </h3> <div class="highlight js-code-highlight"> <pre class="highlight plaintext"><code>npx -y ghost-qa@latest test http://localhost:3000 </code></pre> </div> <div class="ltag-github-readme-tag"> <div class="readme-overview"> <h2> <img src="https://assets.dev.to/assets/github-logo-5a155e1f9a670af7944dd5e12375bc76ed542ea80224905ecaf878b9157cdefc.svg" alt="GitHub logo"> <a href="https://github.com/avivgerz-hue" rel="noopener noreferrer"> avivgerz-hue </a> / <a href="https://github.com/avivgerz-hue/ghost-qa" rel="noopener noreferrer"> ghost-qa </a> </h2> <h3> Autonomous headless browser QA &amp; self-healing verification loop for AI coding agents </h3> </div> <div class="ltag-github-body"> <div id="readme" class="md"><div class="markdown-heading"> <h1 class="heading-element">👻 ghost-qa</h1> </div> <p><strong>Autonomous headless browser QA &amp; self-healing verification loop for coding agents.</strong> <code>v2.0.0</code> — the 8-Trap Deep Browser Inspection Engine: 3 viewports × light/dark, QA Health Score (A+…F), interactive HTML dashboard, and regression diffing.</p> <p><a href="https://github.com/avivgerz-hue/ghost-qa/actions/workflows/ci.yml" rel="noopener noreferrer"><img src="https://github.com/avivgerz-hue/ghost-qa/actions/workflows/ci.yml/badge.svg" alt="CI"></a> <a href="https://www.npmjs.com/package/ghost-qa" rel="nofollow noopener noreferrer"><img src="https://camo.githubusercontent.com/e406adf2de423e34a10c2e195662618e33c5f3aa5759942e055efb9c52d31341/68747470733a2f2f696d672e736869656c64732e696f2f6e706d2f762f67686f73742d71612e737667" alt="npm version"></a> <a href="https://www.npmjs.com/package/ghost-qa" rel="nofollow noopener noreferrer"><img src="https://camo.githubusercontent.com/e47fb75ff10d7e50d809a22f26a1e9794b15f3d66059027ea9611b4d57a0c6ec/68747470733a2f2f696d672e736869656c64732e696f2f6e706d2f646d2f67686f73742d71612e737667" alt="npm downloads"></a> <a href="https://github.com/avivgerz-hue/ghost-qa/./LICENSE" rel="noopener noreferrer"><img src="https://camo.githubusercontent.com/fdf2982b9f5d7489dcf44570e714e3a15fce6253e0cc6b5aa61a075aac2ff71b/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d4d49542d79656c6c6f772e737667" alt="License: MIT"></a> <a href="https://nodejs.org" rel="nofollow noopener noreferrer"><img src="https://camo.githubusercontent.com/231f67d029e8c6bc6169854de7d236401b640e8a31409f14c857832e0f6d1c96/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f6e6f64652d25334525334432302d627269676874677265656e2e737667" alt="Node >= 20"></a> <a href="https://playwright.dev" rel="nofollow noopener noreferrer"><img src="https://camo.githubusercontent.com/b49beb590264116690daca403d50018e4b49c7421428cad982d718151f0fc380/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f706f776572656425323062792d506c61797772696768742d3435626134622e737667" alt="Powered by Playwright"></a></p> <p><a rel="noopener noreferrer" href="https://github.com/avivgerz-hue/ghost-qa/./assets/hero-terminal.svg"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fraw.githubusercontent.com%2Favivgerz-hue%2Fghost-qa%2FHEAD%2F.%2Fassets%2Fhero-terminal.svg" alt="ghost-qa terminal preview"></a></p> <p>Coding agents (Claude Code, Codex, Cursor, Windsurf) write code <strong>blind</strong> — then declare victory while the actual browser has React hydration errors, broken buttons, 500ing APIs, or mobile layout overflow.</p> <p><code>ghost-qa</code> fixes that. One command launches a headless browser against your running app, crawls the live DOM, safely pokes every button, traps runtime/network/layout failures, and hands the agent a structured <strong>Self-Healing Bug Report</strong> so it fixes its own bugs <em>before</em> telling you it's done.</p> <div class="highlight highlight-source-shell notranslate position-relative overflow-auto js-code-highlight"> <pre>npx -y ghost-qa <span class="pl-c1">test</span> http://localhost:3000</pre> </div> <p>No test scripts. No config. No mercy for "it works on my machine".</p> <blockquote> <p>Prefer running straight from GitHub instead of npm? <code>npx -y github:avivgerz-hue/ghost-qa test http://localhost:3000</code> works identically — every command in this README accepts either…</p> </blockquote></div> </div> <div class="gh-btn-container"><a class="gh-btn" href="https://github.com/avivgerz-hue/ghost-qa" rel="noopener noreferrer">View on GitHub</a></div> </div> <p>If you run the command on your repo, drop your Grade (<code>A+</code> to <code>F</code>) in the comments!</p> <p><a href="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fdputyfh7rlwpmom8s7lq.png" class="article-body-image-wrapper"><img src="https://media2.dev.to/dynamic/image/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto/https%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2Fdputyfh7rlwpmom8s7lq.png" alt=" " width="800" height="773"></a></p> ai webdev opensource security