VibeCoding Security — Agent Skill
Core Principle
Never trust the client. Every price, user ID, role, subscription status, feature flag, and rate limit counter must be validated or enforced server-side. If it exists only in the browser, mobile bundle, or request body, an attacker controls it.
Additional principles — see core/principles.md:
- Defense in depth: never rely on a single security control
- Fail securely: when something breaks, deny access (fail closed)
- Least privilege: g
[Description truncada. Veja o README completo no GitHub.]