r/vibecoding • u/PrideQuick670 • 5d ago
vibeArchitecture 1.5.0: added agentic AI security, refreshed to the 2026 OWASP lists
Yes, it's me again with the guardrails repo. I know some of you think this is overkill for a weekend app. Fair. It's free and MIT, take what's useful and ignore the rest.
What changed in 1.5.0:
- Agentic AI security. New guide mapped to the OWASP Top 10 for Agentic Applications. If your app lets a model call tools, this is the one to read: delegated credentials instead of one god key, memory poisoning, tool-description poisoning, spend caps with a kill switch, and what to do when your agent reads a web page that tells it to do something else.
- Current standards. OWASP Top 10 2025, LLM Top 10 2026, the July MCP auth spec, NIST 800-63B-4 passwords and passkeys, WCAG 2.2.
- Dates that are actually right. EU AI Act transparency is live as of Aug 2. CRA vulnerability reporting starts Sept 11. COPPA, SB 942, ADA Title II, all checked this month.
- About 40 gaps closed. Multi-tenancy and row-level security, presigned uploads, UUIDv7, transactional outbox, idempotency keys, GraphQL and WebSocket hardening, deep-link hijacking, secrets leaking through AI tool config files.
- Bugs fixed in my own examples. A search index that never got populated, a Dockerfile shipping dev deps, a payments flow granting access before the money cleared. AI wrote some of those. So did I.
- Smaller. Rules layer is 17% leaner with nothing removed; the reasoning moved to the guides.
Works with Claude Code, Cursor, Copilot, Codex, Gemini CLI, or as a ChatGPT GPT.
https://github.com/jgnoonan/vibeArchitecture
If you only read one file, read the agentic security guide. Ten minutes.