Security plugins for VibeControls
Security lifecycle orchestrator — dispatches every dev / pr / merge / build / release stage to the right per-stage security provider.
14 per-lifecycle-stage security providers — secrets, SAST, DAST, SBOM, scorecards, signing, runtime, release gates.
vibe plugin install @vibecontrols/vibe-plugin-security
14 providers
Each provider implements the Security contract for a specific backend. Install the meta plugin plus the provider(s) you need.
Archive Offboard
Writes tombstone.json evidence at archive.offboard for SOC2/ISO retention proofs.
@vibecontrols/vibe-plugin-security-archiveDAST (preview)
OWASP ZAP baseline DAST scan against alpha preview URLs at deploy.preview.
@vibecontrols/vibe-plugin-security-dast-previewDeploy alpha smoke
TLS / HSTS / CSP smoke checks for alpha environment URLs at deploy.alpha.
@vibecontrols/vibe-plugin-security-deploy-alphaDeveloper local
Local pre-commit secrets scanner (gitleaks protect) — runs on the developer machine.
@vibecontrols/vibe-plugin-security-developer-localIncident response
Targeted incident-response scanner for incident.response lifecycle stage.
@vibecontrols/vibe-plugin-security-incidentRepo onboard
Repo profile detector — picks the right policy bundle on repo.onboard.
@vibecontrols/vibe-plugin-security-onboardPackage publish
Cosign signing + SLSA provenance at package.publish.
@vibecontrols/vibe-plugin-security-package-publishRelease gate
OPA-backed release-gate at promote.prod — block on policy, evidence-required deploys.
@vibecontrols/vibe-plugin-security-release-gateScheduled rescan
Nightly Grype offline rescan against last-built SBOMs.
@vibecontrols/vibe-plugin-security-rescanRuntime continuous
Trivy + kube-bench continuous runtime checks against live workloads.
@vibecontrols/vibe-plugin-security-runtimeSAST deep
Full SAST + SCA sweep (Semgrep + osv-scanner) on pull_request.deep.
@vibecontrols/vibe-plugin-security-sast-deepSBOM build
Syft CycloneDX SBOM + Grype scan at build lifecycle stage.
@vibecontrols/vibe-plugin-security-sbom-buildOpenSSF Scorecard
OpenSSF Scorecard checks at main.merge — track posture over time.
@vibecontrols/vibe-plugin-security-scorecardSecrets (PR)
Gitleaks-backed secret scanner for pull_request.fast — fail fast on PR.
@vibecontrols/vibe-plugin-security-secrets-pr