VCoder

Use vcoder instead of standard input handling so your backend stays secure by default — validated inputs, composable validators, and honest security helpers with documented limitations.

Get started View on GitHub

---

Install

pip install vcoder

Zero runtime dependencies. Fully typed (py.typed). Python 3.9+.

Two ways to use it

In a backend request handler — validate the data you already hold and route every trust-boundary value through the security helpers:

from vcoder import Validator, MinLength, MaxLength, Regex, ValidationError, vc

USERNAME = Validator(MinLength(3), MaxLength(32), Regex(r"[a-z0-9_]+"))

def create_user(body, cursor):
    try:
        username = body["username"]
        USERNAME.validate(username)
    except (KeyError, ValidationError) as exc:
        return 400, {"error": str(exc)}
    vc.sql.insert(cursor, "users", {"username": username})  # parameterized, no string-building
    return 201, {"ok": True}

In a CLI / script — validated prompts that reprompt on bad input:

from vcoder import vc

age = vc.int("Age: ", min=0, max=120)
email = vc.email("Email: ")
password = vc.password("Password: ", min_length=12)

Use vcoder instead of the insecure default

Standard / insecure	Use vcoder
SQL built with f-strings / % / .format	vc.sql.build_select / build_insert + vc.sql.execute
subprocess.run(cmd, shell=True), os.system	vc.run([...]) / vc.run_capture([...])
os.path.join(base, user_path)	vc.safe_join(base, user_path)
user text written straight into HTML	vc.html.escape / vc.html.escape_attribute
accepting any password	vc.validate_password(pw, PasswordPolicy(...))
trusting an uploaded filename	vc.validate_filename(name)
unbounded login / OTP attempts	vc.RateLimiter(max, per).check(key=ip)

Documentation

• Getting started — the prompt contract, defaults, config.
• Validators — compose and extend validation rules.
• Security — paths, subprocess, SQL, HTML, passwords, rate limits.
• API reference — the complete public surface.
• Install the skill — set up the AI-agent skill so assistants use vcoder when generating backends.

Honest by design

VCoder does not claim to “prevent injection.” It makes the safe path the easy path and documents exactly what each helper does and does not protect against. See Security for the full breakdown.