Skip to content Navigation Menu sarthakrastogi safe-vibe-coding Type / to search Code Issues Pull requests Actions Projects Wiki Security Insights Settings Owner avatar safe-vibe-coding Public sarthakrastogi/safe-vibe-coding Go to file t Name sarthakrastogi sarthakrastogi Add readme c8a88a7 · 2 months ago LICENSE Initial commit 2 months ago README.MD Add readme 2 months ago Repository files navigation README MIT license Safe Vibe Coding 🛡️✨ GitHub Stars A comprehensive guide for non-technical creators who want to code safely while maintaining their creative flow Contributions Welcome License Table of Contents Introduction What is Vibe Coding? Why Security Matters for Creative Coders Essential Security Concepts Made Simple Protecting Your Secrets: Environment Variables and API Keys Safe Authentication Using Third-Party Tools Security Checklist for Every Project Common Mistakes and How to Avoid Them Recommended Tools and Services Emergency Response: What to Do When Things Go Wrong Building Security Habits Primer If you prefer to first read a summary of this guide, read this 2-min post (recommended): Substack Introduction Welcome to Safe Vibe Coding! This guide is designed specifically for creative minds, hobbyists, and non-technical builders who want to bring their ideas to life through code without compromising on security. Every amazing project deserves to be protected. Not because you're paranoid, but because you're building something that matters. What is Vibe Coding? Vibe coding is about maintaining your creative energy while building. You know that feeling when you're in flow state, ideas are clicking, and code is just flowing? That's vibe coding. Safe vibe coding means you get to keep all that creative energy while building in protection that works behind the scenes. Why Security Matters for Creative Coders Protecting What You Build Your projects represent hours, days, maybe months of creative work. Here's what good security practices actually protect: Risk Without Security With Security Code theft Anyone can access your repositories Private repos, access controls API abuse Unlimited charges on your accounts Rate limiting, key rotation User data breaches Personal info exposed publicly Encryption, proper access controls Service interruption Site goes down, users can't access Backups, incident response plans Reputation damage Users lose trust permanently Quick response, transparent communication Quick Start Guide Essential Security Setup (10 minutes): Create .env file for secrets Add .env to .gitignore Set up authentication service Configure HTTPS Enable basic monitoring Essential Security Concepts Made Simple Authentication vs Authorization Concept Real-World Example In Your App Authentication Showing ID at a concert User logs in with password Authorization Checking if you have VIP access User can edit only their own posts The Principle of Least Privilege Give each user, service, or system only the minimum access they need to do their job. What Are "Secrets"? Type Examples Why They're Secret API Keys sk-1234abcd... Give access to paid services Database Passwords mySecretPassword123 Control access to all your data Encryption Keys a1b2c3d4e5f6... Decrypt sensitive user information OAuth Tokens Bearer eyJhbGc... Act on behalf of users 🔍 Deep dive: How encryption protects your data Protecting Your Secrets: Environment Variables and API Keys This is probably the most important section for keeping your projects safe. Let's make it bulletproof. The Problem: Hardcoded Secrets # ❌ NEVER do this - secrets visible to everyone import openai openai.api_key = "sk-1234567890abcdef..." # Visible in your code! # ❌ Also bad - config files with secrets config = { 'database_password': 'my_secret_password', # Oops! 'stripe_key': 'sk_live_real_key_here' # Double oops! } Why this is dangerous: Anyone who sees your code gets your secrets Git history keeps secrets forever, even if you delete them later Copy-pasting code accidentally shares your keys Public repositories expose everything to the world The Solution: Environment Variables 🛠️ Step-by-step setup for environment variables Environment Variables for Different Platforms Platform How to Set Example Local Development .env file OPENAI_API_KEY=sk-dev-123 Heroku Dashboard or CLI heroku config:set OPENAI_API_KEY=sk-prod-456 Vercel Web interface Environment Variables section Netlify Site settings Build & deploy → Environment variables Railway Variables tab Add variable button Advanced Secrets Management Solution Best For Price Range Key Features Doppler Teams starting out Free → $3/user/month Git sync, easy sharing 1Password CLI Individual developers $8/month Integrates with password manager AWS Secrets Manager AWS-hosted apps $0.40/secret/month Auto-rotation, fine permissions HashiCorp Vault Large organizations Open source + support Advanced features, self-hosted 💡 Setting up Doppler for team projects What to Do If Secrets Get Exposed Immediate Response (First 5 minutes): Revoke the exposed secret in the service (AWS, OpenAI, etc.) Generate a new secret to replace it Update your application with the new secret Check recent activity for any unauthorized usage Git History Cleanup: # Remove file from entire git history (DANGER: rewrites history) git filter-branch --force --index-filter \ 'git rm --cached --ignore-unmatch .env' \ --prune-empty --tag-name-filter cat -- --all # Force push (coordinate with team first!) git push --force --all Prevention for Next Time: Set up secret scanning in your repository Use pre-commit hooks to catch secrets before commits Regular team training on secret management Safe Authentication Using Third-Party Tools Building secure login systems from scratch is incredibly complex. Smart developers use proven, battle-tested services instead. Why Third-Party Authentication? Loading Popular Authentication Services Service Perfect For Pricing Standout Feature Auth0 Complex apps with specific needs Free: 7,000 users Most customizable Clerk Modern apps wanting great UX Free: 10,000 users Beautiful UI components Supabase Apps needing database + auth Free: 50,000 users Open source, PostgreSQL Firebase Auth Google ecosystem apps Pay-per-use Real-time features Setting Up Auth0 (Step by Step) 🚀 Complete Auth0 setup walkthrough Social Login Setup Loading Setting up Google OAuth: Google Cloud Console Create new project Enable Google+ API Create OAuth 2.0 credentials Add Auth0 callback URL Auth0 Configuration Go to Authentication → Social → Google Enter Client ID and Secret from Google Configure scopes (email, profile) Test the connection Your App Nothing changes in your code! Users now see Google login option Same authentication flow Security Best Practices Practice Why It Matters How to Implement Token Expiration Limits damage if tokens stolen Set short expiry (15 min access, 7 day refresh) Secure Storage Prevents token theft Use httpOnly cookies, not localStorage Multi-Factor Auth Extra protection layer Enable in Auth0 dashboard Rate Limiting Prevents brute force Built into most auth services 🔒 Advanced authentication security Security Checklist for Every Project Use this checklist to ensure you don't miss critical security steps. Check off items as you complete them! 🚀 Project Startup (Before You Code) Loading Environment Setup: Create .gitignore with common sensitive patterns Set up .env.example template Configure environment variables for secrets Verify .env is not tracked by git Choose authentication service (Auth0, Clerk, etc.) Repository Security: Set repository to private (if needed) Enable branch protection on main branch Configure automated security scanning Set up vulnerability alerts Add security-focused README section 💻 During Development Secure Coding Practices: Use environment variables for all secrets Validate all user inputs Use parameterized database queries Implement proper error handling Add authentication to protected routes Use HTTPS in development when possible Before Each Commit: Scan for accidentally committed secrets Review changes for security issues Test with invalid/malicious inputs Update dependencies if needed 🔌 Third-Party Integrations Loading API Security: Use official SDKs when available Implement API rate limiting Validate all API responses Use minimal required permissions Log API interactions (without secrets) Handle API failures gracefully Database Security: Use connection pooling Enable automated backups Use least-privilege database users Encrypt sensitive data columns Enable query logging for monitoring 🚀 Pre-Deployment Infrastructure Security: Configure HTTPS with valid certificates Set security headers (CSP, HSTS, etc.) Configure CORS properly Set up firewall rules Enable logging and monitoring Configure automated backups Production Environment: Change all default passwords Disable debug modes Configure production logging levels Set up health checks Test backup and recovery 📊 Post-Deployment Monitoring Monitoring Area Check Frequency Key Metrics Security Logs Daily Failed logins, unusual access patterns Dependencies Weekly Security updates, vulnerability reports Access Control Monthly User permissions, API key usage Backups Monthly Backup integrity, recovery testing Ongoing Maintenance: Monitor security advisories Update dependencies regularly Review access logs for anomalies Test incident response procedures Conduct periodic security reviews 🎯 Project-Specific Considerations 💳 E-commerce Applications 👥 Social Applications 📱 Mobile Applications 🛠️ Security Tools Integration # Add to your development workflow npm audit # Check dependencies git secrets --scan # Scan for secrets pre-commit run --all-files # Run security checks Recommended Tools Setup: Dependency vulnerability scanning Secret detection in commits Static code analysis Automated security testing Infrastructure monitoring Common Mistakes and How to Avoid Them Learning from common pitfalls helps you avoid expensive and embarrassing security incidents. These mistakes happen to developers at all skill levels. 🔑 Mistake 1: Hardcoding Secrets Loading What it looks like: # ❌ Never do this API_KEY = "sk-1234567890abcdef..." DATABASE_PASSWORD = "my_secret_password" STRIPE_KEY = "sk_live_actual_live_key" Why developers do it: Quick testing - "I'll fix it later" Doesn't seem important in early development Unfamiliarity with environment variables Time pressure to get something working The real consequences: Financial damage: Exposed API keys = unlimited charges Data breaches: Database credentials give access to everything Permanent exposure: Git history keeps secrets forever Reputation damage: Users lose trust in your security How to avoid it: # ✅ Correct from day one import os from dotenv import load_dotenv load_dotenv() API_KEY = os.getenv('API_KEY') DATABASE_PASSWORD = os.getenv('DATABASE_PASSWORD') # Add validation if not API_KEY: raise ValueError("API_KEY environment variable required") 🔐 Mistake 2: Weak Authentication The problem: # ❌ Terrible authentication def login(username, password): user = get_user(username) if user and user.password == password: # Plain text! session['logged_in'] = True return "success" return "failed" Why this happens: Authentication seems simple but has many hidden complexities Following basic tutorials not meant for production Underestimating the security expertise required Thinking "I can build this better than existing services" The real consequences: Password breaches: Plain text passwords are immediately compromised Session hijacking: Insecure sessions can be stolen and reused Account takeover: Weak auth lets attackers impersonate users Regulatory violations: Poor authentication violates privacy laws The smart solution: // ✅ Use proven authentication services import { useAuth0 } from '@auth0/auth0-react'; function LoginButton() { const { loginWithRedirect } = useAuth0(); return ; } 💉 Mistake 3: Missing Input Validation Loading The problem: # ❌ Dangerous: Direct user input to database def get_user_posts(user_id): query = f"SELECT * FROM posts WHERE user_id = {user_id}" return db.execute(query) # SQL injection risk! # ❌ No validation on API endpoints @app.route('/api/user', methods=['POST']) def create_user(): data = request.json user = User( name=data['name'], # What if this is malicious? email=data['email'], # What if this isn't an email? age=data['age'] # What if this is negative? ) Why developers skip validation: Assumes users will provide good data Validation feels like extra work that slows development Only tests with expected inputs during development Doesn't realize how creative attackers can be The safe approach: # ✅ Safe database queries def get_user_posts(user_id): query = "SELECT * FROM posts WHERE user_id = %s" return db.execute(query, (user_id,)) # Parameterized query # ✅ Comprehensive input validation from marshmallow import Schema, fields, validate class UserSchema(Schema): name = fields.Str(required=True, validate=validate.Length(min=1, max=100)) email = fields.Email(required=True) age = fields.Int(required=True, validate=validate.Range(min=13, max=120)) @app.route('/api/user', methods=['POST']) def create_user(): schema = UserSchema() try: data = schema.load(request.json) except ValidationError as err: return jsonify({'errors': err.messages}), 400 user = User(**data) user.save() 💬 Mistake 4: Revealing Too Much in Error Messages The problem: # ❌ Exposing internal details to attackers try: user = db.execute("SELECT * FROM users WHERE id = %s", (user_id,)) except Exception as e: return f"Database error: {str(e)}" # Shows table structure! # ❌ Stack traces in production @app.errorhandler(500) def internal_error(error): return f"Error: {error}", 500 # Shows file paths, code details Why this happens: Helpful error messages during development stick around Wanting to help users understand what went wrong Framework defaults often show detailed errors Not realizing how much information errors reveal What attackers learn from detailed errors: Database table and column names File paths and directory structure Technology stack and versions Internal application logic The secure approach: # ✅ Safe error handling import logging def get_user(user_id): try: user = db.execute("SELECT * FROM users WHERE id = %s", (user_id,)) return user except Exception as e: # Log details for developers logging.error(f"Database error in get_user: {str(e)}", exc_info=True) # Generic message for users raise Exception("Unable to retrieve user information") # ✅ Production-safe error pages @app.errorhandler(500) def internal_error(error): logging.error(f"Internal server error: {str(error)}", exc_info=True) return "Something went wrong. We're looking into it.", 500 🚪 Mistake 5: Broken Access Control The problem: # ❌ Any logged-in user can access any profile @app.route('/api/user//profile') @login_required def get_user_profile(user_id): user = User.get(user_id) return jsonify(user.to_dict()) # No ownership check! # ❌ Trusting the frontend if (user.role === 'admin') { return // API doesn't verify this! } Why this happens: Confusion between authentication (who are you?) and authorization (what can you do?) Assuming frontend restrictions are sufficient Complexity of implementing proper permission systems Testing only with data the current user should see The secure solution: # ✅ Proper authorization checks @app.route('/api/user//profile') @login_required def get_user_profile(user_id): current_user = get_current_user() # Check ownership or admin status if current_user.id != user_id and not current_user.is_admin(): return jsonify({'error': 'Access denied'}), 403 user = User.get(user_id) return jsonify(user.to_dict()) # ✅ Permission-based access control def require_permission(permission): def decorator(f): @wraps(f) def decorated_function(*args, **kwargs): if not current_user.has_permission(permission): return jsonify({'error': 'Insufficient permissions'}), 403 return f(*args, **kwargs) return decorated_function return decorator @app.route('/api/admin/users') @login_required @require_permission('admin.users.read') def list_users(): return jsonify([u.to_dict() for u in User.all()]) 🔍 Mistake 6: Predictable Resource References The problem: # ❌ Guessable URLs @app.route('/api/document/') @login_required def get_document(doc_id): document = Document.get(doc_id) return jsonify(document.to_dict()) # Users can try doc_id = 1, 2, 3... to see everything! The secure approach: # ✅ Check ownership + use UUIDs import uuid from sqlalchemy_utils import UUIDType class Document(db.Model): id = db.Column(UUIDType(binary=False), primary_key=True, default=uuid.uuid4) owner_id = db.Column(Integer, db.ForeignKey('user.id'), nullable=False) @app.route('/api/document/') @login_required def get_document(doc_id): current_user = get_current_user() document = Document.get(doc_id) if not document: return jsonify({'error': 'Document not found'}), 404 if document.owner_id != current_user.id and not current_user.is_admin(): return jsonify({'error': 'Access denied'}), 403 return jsonify(document.to_dict()) 📊 Mistake 7: No Logging or Monitoring The problem: # ❌ Security events happening in the dark @app.route('/api/login', methods=['POST']) def login(): username = request.json.get('username') password = request.json.get('password') if authenticate(username, password): return jsonify({'token': generate_token(username)}) else: return jsonify({'error': 'Invalid credentials'}), 401 # No record of who tried to log in or failed attempts Why logging gets skipped: Focus on functionality over observability Thinking logs are only for debugging Not realizing how crucial they are for security Complexity of setting up proper logging The solution: # ✅ Comprehensive security logging import logging from datetime import datetime # Set up security-specific logger security_logger = logging.getLogger('security') handler = logging.FileHandler('security.log') handler.setFormatter(logging.Formatter( '%(asctime)s - %(levelname)s - %(message)s' )) security_logger.addHandler(handler) security_logger.setLevel(logging.INFO) @app.route('/api/login', methods=['POST']) def login(): username = request.json.get('username') password = request.json.get('password') client_ip = request.remote_addr user_agent = request.headers.get('User-Agent', 'Unknown') if authenticate(username, password): security_logger.info(f"Login success - User: {username}, IP: {client_ip}, UA: {user_agent}") return jsonify({'token': generate_token(username)}) else: security_logger.warning(f"Login failed - User: {username}, IP: {client_ip}, UA: {user_agent}") return jsonify({'error': 'Invalid credentials'}), 401 🛡️ Prevention Strategies Loading Loading Loading Loading Loading Systematic Prevention: Strategy Implementation Frequency Code Reviews Security checklist, peer review Every commit Automated Scanning Pre-commit hooks, CI/CD integration Continuous Team Training Security workshops, best practices Monthly Testing Security test cases, penetration testing Each release 🔧 Setting up automated security checks Recommended Tools and Services The right tools make security implementation much easier. Here's a curated list of developer-friendly options. 🔐 Secrets Management Tool Best For Price Why We Love It Doppler Teams getting serious Free → $3/user/month Git sync, beautiful UI, team collaboration 1Password CLI Individual devs $8/month Integrates with existing workflow AWS Secrets Manager AWS users $0.40/secret/month Auto-rotation, fine-grained permissions Infisical Privacy-focused teams Free (self-hosted) Open source, end-to-end encrypted Loading 💡 Doppler Quick Setup Guide 🔑 Authentication Services Loading Service Perfect When Pricing Setup Time Clerk Want beautiful UI out of the box Free: 10k users 15 minutes Auth0 Need extensive customization Free: 7k users 30 minutes Supabase Want auth + database together Free: 50k users 20 minutes Firebase Building with Google services Pay per use 15 minutes 🛠️ Development Security Tools Static Analysis & Code Quality: Tool Language Focus Strength Integration SonarQube Multi-language Comprehensive analysis CI/CD, IDEs CodeQL Multi-language GitHub-native, powerful GitHub Actions Semgrep Multi-language Fast, customizable CLI, CI, cloud ESLint Security JavaScript JS-specific patterns npm, webpack Dependency Management: # Built-in scanners npm audit # Node.js pip-audit # Python bundle audit # Ruby # Enhanced scanning snyk test # Multi-language, detailed safety check # Python security focus retire.js # JavaScript vulnerabilities Secret Scanning: # Prevent secrets in commits git secrets --install detect-secrets scan --all-files > .secrets.baseline # Scan git history for existing secrets trufflehog git https://github.com/your/repo.git 🔧 Setting up comprehensive security scanning 🌐 Infrastructure Security SSL/TLS Certificate Management: Service Best For Cost Setup Difficulty Let's Encrypt Personal projects Free Easy with Certbot Cloudflare SSL Need CDN too Free tier Very easy AWS Certificate Manager AWS hosting Free Easy for AWS users Web Application Firewalls: Loading Service Strength Best For Complexity Cloudflare DDoS protection, global CDN Most web apps Low AWS WAF Custom rules, AWS integration AWS-hosted apps Medium Sucuri Malware scanning WordPress sites Low 📊 Monitoring and Alerting Application Monitoring: Service Focus Pricing Model Best Feature Sentry Error tracking Per event Beautiful error details LogRocket User sessions Per session Session replay New Relic Full-stack APM Per host Infrastructure insights DataDog DevOps monitoring Per host Custom dashboards Setting up Sentry for Error Tracking: // Install npm install @sentry/react // Configure import * as Sentry from "@sentry/react"; Sentry.init({ dsn: process.env.REACT_APP_SENTRY_DSN, environment: process.env.NODE_ENV, }); // Use try { riskyOperation(); } catch (error) { Sentry.captureException(error); } 💾 Backup and Recovery Database Backup Solutions: Loading Solution Best For Key Features AWS RDS Backups AWS databases Point-in-time recovery, automatic Google Cloud SQL Google Cloud Automated + on-demand backups MongoDB Atlas MongoDB apps Continuous backup, global clusters Custom Scripts Self-hosted Full control, cost-effective 💰 Cost-Effective Security Stack For Personal/Small Projects (Free - $25/month): Auth: Clerk or Supabase (free tiers) Secrets: 1Password CLI or Doppler (free tier) SSL: Let's Encrypt (free) Monitoring: Sentry (free tier) Hosting: Vercel/Netlify (includes basic security) Growing Team ($25 - $100/month): Auth: Auth0 or Clerk (paid tier) Secrets: Doppler team plan Infrastructure: Cloudflare Pro Monitoring: Sentry/LogRocket paid tiers CI/CD: GitHub Actions (included) Production Scale ($100+/month): Full monitoring: DataDog or New Relic Advanced WAF: Cloudflare Business Enterprise auth: Auth0/Okta enterprise Compliance tools: Security audit platforms 🎯 Tool Selection Framework Choose based on your priorities: Priority Recommended Approach Speed Clerk + Vercel + Sentry Cost Supabase + Let's Encrypt + Free tools Control Self-hosted options + open source Scale AWS/GCP + enterprise tools Team Doppler + Auth0 + collaborative tools Decision Matrix Template: Tool Evaluation (1-5 scale): - Ease of setup: ⭐⭐⭐⭐⭐ - Documentation quality: ⭐⭐⭐⭐⭐ - Community support: ⭐⭐⭐⭐ - Pricing fit: ⭐⭐⭐ - Feature completeness: ⭐⭐⭐⭐⭐ - Vendor lock-in risk: ⭐⭐⭐ Total: 22/30 Emergency Response: What to Do When Things Go Wrong Even with the best security practices, incidents can happen. Having a clear response plan can mean the difference between a minor issue and a major disaster. 🚨 Immediate Response (First 15 Minutes) Loading The 15-Minute Emergency Protocol: Minutes Action Priority 0-2 Assess what's happening 🔥 Critical 2-7 Contain the damage 🔥 Critical 7-10 Document and preserve evidence 🔸 Important 10-15 Alert team and start communication 🔸 Important Quick Response Checklist: Change compromised passwords/API keys immediately Block suspicious IP addresses Take compromised systems offline if needed Screenshot error messages and suspicious activity Save log files before they get overwritten Notify key team members Start timeline documentation 🔑 Common Incident Types 🚨 Exposed API Keys or Secrets 🔓 Data Breach or Unauthorized Access 👤 Compromised User Accounts 📞 Communication During Incidents Internal Team Alert Template: 🚨 SECURITY INCIDENT - IMMEDIATE ACTION REQUIRED Summary: [Brief description of what happened] Detected: [Time and how it was discovered] Impact: [Affected systems/users/data] Status: [Ongoing/Contained] Immediate Actions Taken: - [List key containment steps completed] Team Assignments: - @TechLead: Investigate root cause - @DevOps: Monitor systems and implement blocks - @Support: Handle user communications - @Manager: Coordinate with legal/PR if needed Next Update: [Time for next status update] Incident Channel: #security-incident-[date] DO NOT discuss outside the response team until we have a coordinated plan. User Communication (if data affected): Subject: Important Security Notice Hi [Name], We recently discovered a security issue that may have affected your account. Here's what you need to know: What happened: [Simple, clear explanation without technical details] Your information: [Specifically what data may have been accessed - be precise] What we've done: ✓ Fixed the security issue ✓ Implemented additional protections ✓ Notified appropriate authorities What you should do: 1. Change your password immediately 2. Enable two-factor authentication if you haven't 3. Monitor your account for unusual activity 4. Contact us with any concerns We take your security seriously and sincerely apologize for this incident. Questions? Reply to this email or visit [support page] 🔄 Recovery and Learning 📋 Post-Incident Recovery Process Post-Incident Review Template: 🔍 INCIDENT POST-MORTEM Incident: [Brief title] Date: [When it occurred] Duration: [How long it lasted] Impact: [Scope and severity] TIMELINE: [Detailed chronological sequence of events] ROOT CAUSE ANALYSIS: Primary Cause: [Main vulnerability that was exploited] Contributing Factors: [Other issues that made it possible] Human Factors: [Process or training gaps] WHAT WORKED WELL: - [Positive aspects of the response] - [Tools/processes that helped] - [Team coordination successes] WHAT COULD IMPROVE: - [Response time issues] - [Communication gaps] - [Tool limitations] PREVENTION MEASURES: Immediate fixes applied: - [Changes made to prevent recurrence] Long-term improvements planned: - [Broader security program enhancements] ACTION ITEMS: - [ ] [Specific task] - @owner - Due: [date] - [ ] [Another task] - @owner - Due: [date] 🛠️ Building Response Capabilities Essential Incident Response Toolkit: # Create incident response directory mkdir ~/incident-response-toolkit cd ~/incident-response-toolkit # Quick log analysis script cat > analyze-logs.sh << 'EOF' #!/bin/bash echo "🔍 Security Log Analysis - $(date)" echo "================================" # Authentication failures echo "Failed logins (last 100):" grep -i "failed\|invalid" /var/log/auth.log | tail -100 # Web server errors echo -e "\nHTTP errors (4xx, 5xx):" grep -E " (4[0-9]{2}|5[0-9]{2}) " /var/log/nginx/access.log | tail -50 # Database connection issues echo -e "\nDatabase errors:" grep -i "database\|connection" /var/log/application.log | tail -20 EOF # Evidence preservation script cat > preserve-evidence.sh << 'EOF' #!/bin/bash INCIDENT_ID="incident-$(date +%Y%m%d-%H%M)" EVIDENCE_DIR="/secure-backup/$INCIDENT_ID" mkdir -p "$EVIDENCE_DIR" echo "📁 Preserving evidence in $EVIDENCE_DIR" # Copy critical logs cp /var/log/auth.log "$EVIDENCE_DIR/" cp /var/log/nginx/access.log "$EVIDENCE_DIR/" cp /var/log/application.log "$EVIDENCE_DIR/" # System state snapshot ps aux > "$EVIDENCE_DIR/processes.txt" netstat -tulpn > "$EVIDENCE_DIR/network.txt" df -h > "$EVIDENCE_DIR/disk-usage.txt" # Package current system state tar -czf "$EVIDENCE_DIR.tar.gz" "$EVIDENCE_DIR" echo "✅ Evidence preserved: $EVIDENCE_DIR.tar.gz" EOF chmod +x *.sh Emergency Contact List Template: 🚨 EMERGENCY CONTACTS INTERNAL TEAM: - Tech Lead: [name] - [phone] - [email] - Security Lead: [name] - [phone] - [email] - Manager: [name] - [phone] - [email] - On-call Engineer: [rotation schedule/contact] EXTERNAL SERVICES: - Hosting Provider: [emergency support number] - Domain Registrar: [support contact] - Payment Processor: [fraud department] - Auth Service: [enterprise support if available] ESCALATION CONTACTS: - Legal Counsel: [emergency number] - PR/Communications: [contact info] - Insurance Provider: [cyber insurance contact] ESCALATION THRESHOLDS: Level 1: Technical team handles (minor issues) Level 2: Management notified (potential data exposure) Level 3: Legal/PR involved (confirmed data breach) Level 4: Law enforcement (criminal activity suspected) Building Security Habits The most effective security comes from habits that become second nature, not from sporadic intense efforts. 🌅 Daily Security Habits (5 minutes) Loading Morning Security Routine: #!/bin/bash # daily-security-check.sh - Run this before you start coding echo "🛡️ Daily Security Check - $(date)" echo "=================================" # Check for dependency updates echo "📦 Dependency Status:" if command -v npm &> /dev/null; then npm outdated 2>/dev/null | head -5 || echo "✅ No npm updates needed" fi if command -v pip &> /dev/null; then pip list --outdated 2>/dev/null | head -5 || echo "✅ No Python updates needed" fi # Quick secret scan echo -e "\n🔍 Secret Scan:" if command -v git-secrets &> /dev/null; then git secrets --scan || echo "⚠️ Potential secrets found - review before committing" else echo "💡 Consider installing git-secrets for automatic scanning" fi # System security updates echo -e "\n🔄 System Updates:" if command -v apt &> /dev/null; then apt list --upgradable 2>/dev/null | head -3 || echo "✅ System up to date" elif command -v brew &> /dev/null; then brew outdated | head -3 || echo "✅ Homebrew up to date" fi # Recent security events echo -e "\n📊 Recent Activity:" if [ -f ~/.ssh/known_hosts ]; then echo "SSH connections: $(wc -l < ~/.ssh/known_hosts) known hosts" fi echo -e "\n✅ Daily security check complete!" echo "Happy coding! 🚀" Pre-Commit Security Check: #!/bin/bash # pre-commit-security.sh echo "🔒 Pre-Commit Security Check" echo "==========================" # Check for potential secrets echo "🔍 Scanning for secrets..." if grep -r -i "password\|secret\|key.*=\|token.*=" --include="*.py" --include="*.js" --include="*.env*" .; then echo "⚠️ Potential secrets detected!" echo "Review the above findings before committing." read -p "Continue anyway? (y/N): " -n 1 -r echo if [[ ! $REPLY =~ ^[Yy]$ ]]; then echo "❌ Commit aborted for security review" exit 1 fi fi # Verify .env files aren't being committed if git diff --cached --name-only | grep -E "\.env$|\.env\."; then echo "❌ .env file detected in commit!" echo "Add .env files to .gitignore and remove from commit" exit 1 fi # Check for TODO security items echo "📝 Security TODOs:" if grep -r "TODO.*security\|FIXME.*security" --include="*.py" --include="*.js" .; then echo "⚠️ Don't forget to address security TODOs!" else echo "✅ No pending security TODOs" fi echo "✅ Pre-commit security check passed!" Contributing Contributions are welcome! If you have any ideas, please create a new GitHub Issue or submit a pull request. Support DM the creator on LinkedIn 💭 GitHub Issues 🐛 Star History You can star ⭐️ this repo to stay updated. Star History Chart About How to vibe code apps without causing security nightmares for yourself and your users Resources Readme License MIT license Activity Stars 19 stars Watchers 0 watching Forks 2 forks Releases No releases published Create a new release Packages No packages published Publish your first package Footer © 2025 GitHub, Inc. Footer navigation Terms Privacy Security Status Community Docs Contact Manage cookies Do not share my personal information