Vibe coding means describing what you want and accepting what the assistant writes. It is fast, and it moves the weak point. The question changes from "did I write this correctly" to "did I read this at all".
You will not stop people from doing it, and you should not try. What you can do is make sure something checks the output every time, whether or not the author looked closely.
What it is
A secure vibe coding setup has three layers. Each catches what the one before it misses.
- Inside the assistant: Safeguard over MCP, so the assistant can check a package or finding while it writes.
- In the editor: the Safeguard IDE extension, so you see security insight as code appears.
- At the pull request: gates that block a merge when a rule is broken.
No layer needs to be perfect. The point is that skipping a check requires effort, and the default is checked.
How to use it
Layer 1: MCP in your assistant
Connect your assistant to the Safeguard MCP server at https://mcp.safeguard.sh. Then give it a standing instruction:
Before adding any dependency, check it with Safeguard. If it has a critical vulnerability or is flagged malicious, pick another or tell me why not.
AI assistants sometimes suggest packages that do not exist or that were published to catch exactly that mistake. A lookup before install is cheap.
Layer 2: the IDE
Safeguard has extensions for VS Code, Open VSX (which works in Cursor) and JetBrains IDEs. They show security insight as you code, so a suggestion that adds a risky call is flagged while it is still on screen.
Layer 3: the gate
Run the Safeguard CLI in CI to scan and gate. It outputs SARIF and JUnit, which most CI systems understand. A pull request that adds a vulnerable dependency or a secret fails the check, no matter who or what wrote it.
What the layers catch
- Invented or look-alike package names.
- Dependencies with known exploited vulnerabilities.
- Secrets pasted into code to make an example work.
- Insecure patterns the model learned from old code.
What they do not catch
Logic mistakes specific to your business. Someone still has to understand what the code is supposed to do. Treat the security layers as the floor, not as a replacement for review.
Try it yourself
Ask your assistant to add a feature that needs a new library, then see what each layer says. The demo shows a guardrail on MCP traffic, which is the first layer.
Click through it at your own pace, or open it full screen.
For the gate layer, see how a pull request is held in this demo, and for the editor layer, this one.
Quick check
Why check dependencies before install when an AI suggests them?
Assistants can suggest packages that do not exist or that are malicious look alikes. A lookup first costs seconds.
Which layer is the last line of defense?
The pull request gate. It applies to every change regardless of who wrote it.
