Anshuman Bhartiya

Interviewed by Confidence Staveley

It started with a text from an old friend. He had vibe-coded an application to support a business idea using a platform like Replit. It worked. His customers could use it. But he had one question: Is it secure?

‘He obviously cannot afford the super expensive security scanners and tools,’ says Anshuman Bhartiya, AppSec Tech Lead at Lyft. ‘So what can I do to help him out?’

That question led Bhartiya to build SecureVibes, an open-source security scanner designed specifically for vibe-coded applications. He built it using Claude Code, and he didn’t write a single line of code himself.

The Problem With Traditional Security Tools

Bhartiya’s frustration with existing tools runs deep. ‘Traditional SAS tools are rules-based engines. They don’t understand the context of an application. They don’t understand your code base either. They just have a rule, and they’re trying to execute that rule against the code.’

The core issue: AI is trained on internet data, and internet data is full of security vulnerabilities. Without proper context, AI will generate code that works but isn’t safe.

How Security Engineers Actually Review Code

Bhartiya asked himself: ‘If I am a security engineer and if I were to review this code base, how would I go about it?’ The answer became SecureVibes’ architecture:

The Three-Phase Approach

1. Architecture Assessment: Understand what the application is doing. What are the different components? How is data flowing from source to sink?
2. Threat Modeling: Put on the attacker’s hat. With architecture understanding, come up with attacks and threats.
3. Code Review: Validate those threats in the actual code. This is contextual, not generic.

The Four-Agent Architecture

SecureVibes uses the Claude Agent SDK to create four specialized sub-agents, each maintaining its own context window to prevent confusion and hallucination:

Agent 1: Orchestrator — Coordinates the workflow between all other agents. Acts as the conductor of the security symphony.

Agent 2: Architecture Assessor — Analyzes the application structure, components, and data flows before any vulnerability hunting begins.

Agent 3: Threat Modeler — Uses architecture understanding to identify potential attack vectors and threats specific to this application.

Agent 4: Code Assessor — Validates identified threats against the actual code. Finds real vulnerabilities, not generic patterns.

Why Multi-Agent Beats Single-Agent

‘Context engineering is key,’ Bhartiya explains. ‘If you don’t get good at context engineering, you aren’t going to be able to build a very robust product that can work in production.’

Sub-agents in the Claude Agent SDK maintain their own context windows, operating mutually exclusive from each other. This prevents the confusion that leads to hallucination when a single agent tries to juggle too many objectives.

Baking Determinism Into Non-Deterministic Systems

AI systems are fundamentally non-deterministic: you know the input, you know what the output should look like, but you don’t control how the agent gets from point A to point B. Multiple runs may produce different reasoning paths even when reaching the same conclusion.

Bhartiya’s solution: hooks and JSON schemas.

The Hooks Technique

Hooks fire before an agent acts or when it finishes an objective. They can validate whether output conforms to a defined JSON schema. If output doesn’t match, the hook makes the agent correct its behavior on the fly. This is what differentiates POCs from things that can actually be deployed.

Claude Skills: The Underrated Feature

‘Claude skills is very underrated. It is very underhyped,’ Bhartiya says. ‘I say this with confidence because the new system I’m working on uses skills, and I can see how the agent behavior is changing.’

Skills define exactly how you want the agent to do something. Without a skill, vulnerability triage might be inconsistent across runs. With a skill, there’s a 95% probability the agent will follow the defined approach.

Skill Expansion Possibilities

The threat model agent could have multiple skills: threat modeling agentic applications, threat modeling general web applications, and threat modeling iOS applications. Community-contributed skills could make the tool infinitely extensible.

Memory Management: Keep It Simple

‘Folks are getting intimidated and overwhelmed, thinking about memory and context management,’ Bhartiya says. ‘My point is we can keep it really simple.’

In SecureVibes, different agents communicate their results via a markdown file that gets shared between them. Start minimal, then expand.

What’s Next: VulnVibes and the Fixer Agent

Bhartiya is working on a new tool called VulnVibes that can triage vulnerabilities across multiple code bases. ‘I don’t think there’s any open source tool out there that can do that.’

He’s also planning a ‘fixer agent’ that proposes fixes for verified vulnerabilities. ‘As a vibe coder, you don’t want to go fix it. You want somebody else to go fix it.’

The vision: a web-based Cyber Reasoning System (CRS) inspired by DARPA’s AI XCC challenge, but focused on web applications. Not just finding cross-site scripting, but fixing it.

The Future of Security Engineering

Bhartiya’s prediction is bold: ‘I actually believe software engineering is going to go away. Human beings will act as the orchestrator.’

He sees a world where AI generates secure code from the start, eliminating the need for vulnerability management. ‘If we can ideally start getting AI to generate secure code, then we move away from vulnerability management entirely.’

The Call to Community

SecureVibes is open source and looking for contributors. Bhartiya has already received PRs from community members. His challenge to other vendors: he’s building a practical environment to benchmark AI security tools. ‘Go and find stuff. Let’s help improve. Let’s not try to compete against each other.’

SecureVibes is available at securevibes.ai

Watch the full interview at aicybermagazine.com

About The Author

Anshuman Bhartiya is the AppSec Tech Lead at Lyft, a technical advisor, cybersecurity mentor, and cohost of the Boring AppSec podcast. With over a decade of experience at companies like EMC, Intuit, and Atlassian, he has spoken at Black Hat Arsenal, DevCon, Recon Village, and more. He is the creator of SecureVibes and is building VulnVibes for cross-codebase vulnerability triage.