Claude Code -> WriteFile -> Semgrep -> Classifier (to prevent security bug)
Source Reddit Cybersecurity
Discussion
VibeGate is a security tool designed as a pre-write hook for AI coding assistants like Claude Code and Codex. It intercepts every file write operation, scanning the new code with Semgrep to detect unsanitized user input flowing into risky sinks such as SQL queries, shell commands, or HTTP responses. Depending on the risk level, it either allows the file to be saved silently, saves it with a warning, or blocks the save entirely to prevent potential security bugs. The tool supports multiple programming languages and aims to reduce token usage compared to loading large secure coding instructions into AI assistants. It is open source and can be integrated per project to improve secure coding practices automatically.
r/cybersecurity (opens in a new tab)u/theMiddleBlue0 points0 comments
Hi all,
not sure this is the right approach, but I've been testing it in my coding agent. Every time it writes a file, the hook runs Semgrep against it to catch unsanitized user input, then acts as a classifier: it blocks on critical stuff or surfaces a warning depending on the type of input involved. Ends up saving a lot of tokens compared to loading a secure coding skill.
if anyone wants to check the code and give me some feedback, it would be really appreciated :)
https://github.com/theMiddleBlue/vibegate
I started building it as a Claude Code hook after noticing that both Sonnet and Opus often fail to sanitize URLs, leading to SSRF and DNS rebinding, and IMO this is kind of hard to spot than the more obvious stuff like XSS or open redirects.
What do you think? Thanks!