VibeCoding-a-Website: Skill for Claude Code

Security Auditor

Why This Matters

You're building a website with real API keys (Resend, Beehiiv, etc.), form submissions, and serverless functions—but you might not have a security background. That's okay. This audit checks what you can't see: exposed credentials, outdated packages with known vulnerabilities, missing security headers, and privacy compliance gaps.

Security isn't optional. A breached API key can cost thousands. XSS vulnerabilities let hackers steal data from your visitors. This skill finds and fixes these issues in plain language.

---

Audit Areas

1. Secrets Scanning (Critical)

What we check:

• All files for exposed API keys, tokens, passwords
• Git history for accidentally committed secrets
• .env file is in .gitignore
• Hardcoded credentials in JavaScript/functions
• Vercel environment variables properly scoped

Why it matters: One exposed Resend key gives someone your email sending ability. One leaked database URL lets them access your data.

How to fix:

• Never commit .env files
• Use Vercel Environment Variables (Settings → Environment Variables)
• Rotate any exposed credentials immediately
• Add this to .gitignore: .env.local, .env, *.pem

---

2. Dependency Vulnerabilities

What we check:

• Run npm audit for known CVEs
• Identify outdated packages with security patches
• Classify severity (Critical, High, Medium, Low)

Why it matters: Your dependencies might have known exploits. A vulnerable library is a backdoor waiting to be used.

How to fix:

npm audit fix              # Auto-fix minor vulnerabilities
npm audit fix --force      # Fix breaking changes (test after)
npm outdated              # See what's outdated

---

3. Security Headers Audit

These headers tell browsers how to handle your site safely. Missing them = leaving doors unlocked.

Content-Security-Policy (CSP) Prevents inline scripts and restricts where resources load from.

// vercel.json
{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Content-Security-Policy",
          "value": "default-src 'self'; script-src 'self' 'unsafe-inline' cdn.vercel.com; style-src 'self' 'unsafe-inline'"
        }
      ]
    }
  ]
}