Vibe Coding Security Defense Record

Did a security audit for myself and found that more than 10 scripts in the project hardcoded wallet private keys—almost exposed funds on GitHub.

The cause was the IDE vulnerability warned by @evilcos, combined with previous reminders from friends during Polymarket data scraping.

🚨 The most dangerous scenario

Clone a project on GitHub, open it with Cursor—and the private keys are gone.

A configuration file is hidden in the project, and when the IDE opens it, commands are executed automatically without your knowledge. Cursor's official explanation is that this security mechanism is "too complex," so it is turned off by default.

Solution: Settings → Search for workspace trust → Enable

🛡️ My protection system (Figure 1)

The key is to automate protection:
• Malicious IDE projects → Automatic pop-up confirmation
• AI reading private keys → Automatic interception
• Code modifying main → Automatic interception

Manual checks are unreliable; automation is the safety net.

📋 SOP for cloning external projects (Figure 2)

A 5-step check process—develop the habit, and you won't be afraid.

What do you check before cloning external projects?

cc @evilcos @SlowMist_Team 🙏