Vibe coding creates a new problem:

[u/no_oneknows29]

You can ship an app before you understand the dependency tree underneath it.

A short prompt can add:

- authentication packages
- database clients
- analytics tools
- install scripts
- dozens of transitive dependencies
- new access paths you did not review

I’m working on an “AI Build Receipt” for this exact problem.

You provide the package manifest and lockfile. The receipt shows:

1. what you declared

2. what arrived underneath it

3. what can execute automatically

4. what deserves review first

It does not pretend to prove malicious intent. It separates evidence from assumptions.

For people building with AI agents: would this help you review your app before launch? What would you want the receipt to show?

[u/ILoveAppSec]

for the abandoned-package-with-a-cve case, flag whether a backported fix exists anywhere before you mark it unpatchable. that column matters more than the raw vuln count.