What is kapus-secuaudit?
kapus-secuaudit is a security skill for Claude Code and Codex. It acts as a safety net for vibe coding. We all know the drill. You build an app fast. It works. But you forgot to turn on Row Level Security in Supabase. Or you committed your .env file. Or your API route has no auth check.
The app runs but it is wide open. Thxis tool fixes that gap. It is built by Kapus and released under the MIT License so you can use it freely.
What does it do?
It reads your codebase or checks your live URL. It finds security holes and ranks them by severity. Then it gives you a score from 0 to 100. If you want it can fix the issues in your code but only after you approve each change.
It focuses on the five areas where vibe coders make the most mistakes. It checks for exposed secrets like API keys in client bundles. It looks for missing authentication on API routes.
It finds SQL injection risks and unchecked file uploads. It also spots bad config like missing security headers or public storage buckets. You get a clear list of what is wrong where it is and how to fix it.
How does it work?
The skill uses a strong reasoning model to analyze your files. It does not run real attacks. It only reads and performs safe non-destructive probes. It refuses to audit third party sites so you only check your own assets.
If it finds an exposed secret it tells you to rotate the key immediately because adding it to gitignore is too late.
In fix mode it shows you a plan of changes before touching any code. It flags anything that might break your existing flows like adding auth that blocks a public page. You should commit your code first so you can revert if needed. It works best with high reasoning effort settings to avoid false alarms.
Features
- Audits five critical security areas including OWASP vulnerabilities and secret exposure
- Provides a 0 to 100 security score with P0 to P3 severity rankings
- Fixes code automatically after user approval for each change
- Detects hardcoded credentials and keys in git history or client bundles
- Checks for missing Supabase RLS and unauthenticated API routes
- Identifies SQL injection XSS and prompt injection risks
- Validates config for missing security headers and wildcard CORS
- Runs safe read-only probes without executing real exploits
- Requires explicit confirmation before applying any code changes
- Warns to revoke leaked keys before attempting code fixes
License
The project is released as an open-source under the MIT License.
