Security isn't an optional extra

Vibe coding often ends with a system that runs fine but has security holes the author isn't even aware of. That's why in my orchestration the security agent is its own role — it audits the output of other agents, hunts for common vulnerabilities (SQL injection, XSS, auth bypass, IDOR, leaky validation, misconfigured CORS / CSRF / cookies) and checks that the system follows basic security hygiene.

For applications that may be targets of attack — typically payments, sensitive data, authentication — I additionally deploy a local uncensored model for penetration testing. This is an agent that views the system as an attacker rather than a developer, hunting for edge cases that another agent or even a professional tester might miss.