Introducing SecureVibes: A Multi-Agent Security System (3 Part Series)

I built SecureVibes, an open-source multi-agent security system, that can help find security vulnerabilities in your vibecoded applications (and hopefully soon allow you to fix them as well). Unlike single-agent systems, SecureVibes' approach provides more accurate, context-aware vulnerability detection. SecureVibes is built specifically for the vibecoding era - where developers build rapidly on platforms like Replit, Bolt, Lovable and v0.

This 3-part series documents the entire journey—from problem to architecture to validation.

The Complete Series

Part 1: The Vibecoding Security Crisis: Why Current Scanners Fail

Traditional SAST tools miss context. Single-agent AI scanners get overwhelmed. Here's why the future of code security needs multiple agents working together.

Key topics: Traditional SAST limitations, vibecoding security gap, the multi-agent hypothesis

Part 2: Building SecureVibes: A Multi-Agent Security System

A deep dive into the 4-agent architecture: Assessment, Threat Modeling, Code Review, and Report Generation. Plus lessons from prompt engineering hell.

Key topics: Agent architecture, Claude SDK orchestration, file-based communication, prompt engineering

Part 3: Running SecureVibes on SecureVibes: Results & What's Next

Testing the scanner by scanning itself. Comparative benchmarks vs Semgrep, Bandit, Claude Code, and more. Plus the roadmap for what's next.

Key topics: Haiku vs Sonnet vs Opus, comparative results, key learnings, contribution guide

Key Results

• 78-89% more vulnerabilities found than Claude Code (16-17 across 2 runs vs 9)
• 4-4.25x more than Codex (16-17 vs 4)
• Sonnet is the sweet spot: 16-17 vulns at $2.14-$3.44 (vs Opus: 12 at $7.64)
• Traditional SAST (Semgrep, Bandit): 0 findings
• Consistent results: Multiple runs show natural variance while maintaining superior detection

Why Multi-Agent?

When human security teams review applications, they don't just grep for "SQL injection". They follow a three-phase approach:

1. Understand the architecture and data flows
2. Model potential threats based on that architecture
3. Validate which threats manifest as real vulnerabilities in code

SecureVibes encodes this workflow into four specialized AI agents that work in sequence, creating a progressive refinement of analysis.

Links

• GitHub: github.com/anshumanbh/securevibes
• Try it yourself: Follow the README to scan your own codebase

Start reading: Part 1: The Vibecoding Security Crisis: Why Current Scanners Fail