What it is
AI-generated code can move faster than the review habits around it. The failure mode is rarely one dramatic prompt; it is a repo with no automated security checks, no dependency update loop, no secret scanner, and no instruction file telling agents to preserve auth, RLS, CORS, CSP, and test coverage.
How it happens
AI coding tools write and merge changes quickly, so the safety net has to live in the repo. Four guardrails do most of the work: code scanning in CI, a secret scanner, automated dependency updates, and an agent instruction file (AGENTS.md, CLAUDE.md, Copilot instructions, or Cursor rules) that tells the assistant to keep auth, RLS, CORS, and CSP intact. The report lists which of those your repo is missing.
What an attacker gets
Without guardrails, AI-assisted edits can introduce raw SQL interpolation, unsafe HTML sinks, leaked keys, decode-only JWT handling, permissive CORS, or removed authorization checks without any automated system stopping the merge.
// what fixvibe reports
What FixVibe reports
Runs when you connect a GitHub repository, on Pro and above. Each finding shows the file and line, its severity and fix steps you can paste into your AI coding tool.
How to fix it
Add CodeQL or Semgrep, Gitleaks or TruffleHog, Dependabot or Renovate, and normal test/typecheck gates to CI. Update AI-agent instructions to require auth/RLS review, secret handling, OWASP-style checks, no weakening of security controls, and regression tests for security-sensitive changes.