NED SHIPS ITNED SHIPS ITNED SHIPS ITNED SHIPS ITNED SHIPS ITNED SHIPS ITNED SHIPS ITNED SHIPS IT
A free guide from the Ned Ships It video
Vibe Coding Security Checklist: 5 Free Tools
In February 2026, an app built entirely by AI leaked 1.5 million API tokens because one database setting was off. These five free checks catch that and more.
Commented LOCK? This box is yours.
From
Ned, @nedshipsit
To
You
In the box
6 free tools
Checked
October 7, 2026
New to Claude Code? Start hereWhat you need before installing anything
Claude Code, installed and working. Two of the checks live inside it.
Terminal, the app that comes with every Mac (press Cmd + Space, type "Terminal"). Commands in plain grey boxes that start with words like brew or trufflehog go here.
Commands that start with /plugin go inside Claude Code, in the same box where you chat with Claude. They won't work in plain Terminal.
Homebrew, the Mac app installer used by TruffleHog and OSV-Scanner. If brew says "command not found", get it from brew.sh first.
Run scans from your project folder. In Terminal, type cd (with a space), drag your project folder into the window, and press Enter. Or skip all of this and ask Claude Code: "run this command in my project folder."
you don't have to understand every line of output. Copy it, paste it into Claude, and ask "what does this mean and how bad is it?"
The 5 checks
Why bother? GitGuardian found that commits made with Claude Code leaked secrets at a 3.2% rate, versus a 1.5% baseline across all public GitHub commits. Endor Labs found that only 1 in 5 dependency versions recommended by AI coding assistants were safe. And when Tenzai had five AI coding agents build 15 apps, not a single one used CSP, X-Frame-Options or HSTS, three basic browser safety headers.
Paste this into Terminal from your project folder. The read_only=true part means Claude can look but can't change your data.
Paste in Terminal
claude mcp add --scope project --transport http supabase "https://mcp.supabase.com/mcp?read_only=true"
Then log in. In a regular Terminal window (not the VS Code extension) run:
Paste in Terminal
claude /mcp
Pick "supabase", then "Authenticate". A browser window opens. Log in to Supabase and choose the organization that holds your project.
Try it
Start Claude Code in your project and paste:
You, to Claude
Use the Supabase MCP to get the security advisors for my project. List every warning in plain English, tell me which tables anyone on the internet can read, and include the fix link for each one. Don't change anything yet.
You'll get a list of warnings such as "Table publicly accessible", each with a link to Supabase's fix guide.
Heads up Supabase recommends pointing this at a development project when you can, with read-only mode and project scoping turned on. More
You can lock it to one project by adding project_ref=<your-project-id> to the address, for example https://mcp.supabase.com/mcp?project_ref=abc123&read_only=true. Prefer clicking? The same checks live in your Supabase dashboard under Advisors, then Security Advisor.
run this one first. It's the same mistake behind the Moltbook leak.
Any key that still works shows up as "Found verified result". Verified means TruffleHog tested the key against that service and it was live. "Unknown" means it tried to test the key but hit an error, so treat those as suspicious too.
Heads up This scans a project that uses git. More
If your project isn't a git repo, scan the folder instead with trufflehog filesystem .. TruffleHog only finds keys. It doesn't remove or replace them, so see "If it finds something" below.
a verified result is the one that ruins your weekend. Fix those first.
Risky code while Claude is writing it, including injection, XSS, SSRF, hardcoded secrets, IDOR, auth bypass, unsafe deserialization and path traversal.
It's Anthropic's own plugin, and its marketplace comes enabled in Claude Code by default. You need Claude Code v2.1.144 or newer and Python 3.8 or newer on your Mac.
Try it
There's nothing to run. Just build like normal, for example:
You, to Claude
Add a page where logged-in users can delete their own posts.
It works in three layers. It warns the moment Claude writes a known-dangerous pattern. When Claude finishes a turn, it sends the change to a reviewer model and hands serious findings back to Claude to fix before you see the reply. And on every git commit, a deeper reviewer reads related files to catch problems that span several files, like one user reaching another user's data.
Heads up Reviews run on your own Claude plan or API key (the newest Opus by default), so they use some of your usage. More
Anthropic calls it a best-effort tool, not a guarantee, so treat it as one safety net among several.
It looks through your folder for package files like package.json and lists every known vulnerability it finds in the packages you use.
Heads up There's also an experimental osv-scanner fix command that suggests upgrades. More
Google warns it can run scripts from the project, so only use it on code you trust. For most people, pasting the scan results into Claude and asking it to update the packages is easier.
Nothing. It's a free website from Mozilla's MDN. Open:
Open in your browser
https://developer.mozilla.org/en-US/observatory
Prefer Terminal? If you have Node.js, npx @mdn/mdn-http-observatory yoursite.com runs the same scan and prints the results as JSON.
Try it
Type your site's address (like yourapp.com) and press Scan. You'll get a grade from A+ to F plus a list of recommendations. Then give the results to Claude:
You, to Claude
My site got this result on Mozilla's HTTP Observatory: [paste the failed tests here]. Add the missing security headers for my hosting setup and explain what each one does in plain English.
Heads up Scan history for every domain is public, and a site can only be rescanned once every 60 seconds. More
It only checks headers. It won't look at your database, your code or your passwords, which is why the other four checks exist.
Insecure defaults that AI loves to leave behind: fallback secrets like env.get('KEY') or 'dev', seeded admin / admin123 logins, security switches that fail open, weak password hashing and CORS set to *.
It audits your whole project. Before anything lands in your report, a second agent tries to prove each finding wrong.
Heads up Trail of Bits is a professional security audit firm, and the same marketplace has 30+ more security plugins. More
The audit runs several agents at once, so it uses a decent chunk of your Claude usage.
If it finds something
Leaked key? Rotate it first. Go to that service's dashboard, create a new key, put the new key in your app and your hosting settings, then revoke the old key so it stops working. Deleting it from your code isn't enough, because it still lives in your git history.
Table publicly accessible? Turn on Row Level Security. Supabase's fix is alter table <schema>.<table> enable row level security;. After that, the public key can't read or write the table until you add policies, so ask Claude: "Write Row Level Security policies so users can only see and edit their own rows." To apply changes through the MCP, reconnect it without read_only=true, or paste the SQL into Supabase's SQL editor.
Vulnerable package? Update it. Paste the OSV-Scanner results into Claude and ask it to update each flagged package to a version without the hole, then run the scan again to confirm the list is shorter.
Low Observatory grade? Add the headers. Ask Claude to add the missing headers for your host, deploy, wait at least 60 seconds, and scan again. Watch the grade climb.
Plugin finding? Ask Claude to explain it, then fix it. These reviewers can be wrong, so ask "is this real, and what's the risk?" before you accept the change.
Run the checks again after every fix. And again before every launch. Ned: security isn't a one-time chore. Sorry, I don't make the rules.
Questions people ask
Do I need to know how to code to use these?
No. Supabase MCP, Security Guidance and the Trail of Bits skills plug into Claude Code, HTTP Observatory is a website where you type your address, and TruffleHog and OSV-Scanner are one-line commands you can paste into Terminal or simply ask Claude Code to run for you. The hard part is reading the results, and you can paste those straight into Claude and ask what they mean.
Can I scan any website or app I want?
Scan only apps you own or have permission to test. These are defensive tools for checking your own work. Pointing them at someone else's app can get you in trouble, and it doesn't help you ship anything.
Are these tools really free?
Yes, all six are free to use. Supabase MCP, TruffleHog, OSV-Scanner and HTTP Observatory cost nothing to run. Security Guidance and the Trail of Bits skills are free plugins, but they run on your own Claude plan or API key, so they use some of your Claude usage.
I found an API key in my code. Is deleting it enough?
No. The key still sits in your git history, and someone may have copied it already. Make a new key in that service's dashboard, switch your app to the new key, then revoke the old one so it stops working. GitHub's own docs say revoking or rotating the secret comes first.
Where Ned does his homework
The tools are free. Knowing what to ask them for is the real skill. Professor Glitch teaches it from zero, in order, inside the community: 8 courses and 200+ lessons. These two are where Ned started.
run this one first. It's the same mistake behind the Moltbook leak.
