checkvibe

checkvibe 5 Mistakes Hiding In Vibecoded Code The bugs Claude Code and Cursor quietly ship to production. SWIPE → 1 MISTAKE of 5 Vulnerable Dependencies Never Updated AI pins whatever version it was trained on. Months-old packages with known CVEs ship straight into your production bundle. # x Known vulnerabilities $ npm audit 12 high severity vulnerabilities # ✓ Patch them $ npm audit fix $ npm update — THE FIX Run npm audit before every deploy. Patch high-severity issues and keep deps current. checkvibe.dev 2 MISTAKE of 5 Leaking Stack Traces to Production Users Default error handlers dump full stack traces, file paths, and SQL to the response. That's a free map of your backend for attackers. // x Leaks internals res.status(500).send(err.stack) // ✓ Log private, return generic logger.error(err) res.status(500).json({ error: 'Server error' }) — THE FIX Log errors privately. Return a generic message to users and never expose stack traces. checkvibe.dev 3 MISTAKE of 5 Exposed API Keys in Client Code Your OpenAI, Stripe, and Supabase keys are sitting right there in your frontend bundle. Anyone with browser DevTools can steal them in seconds. // x What AI generates const stripe = 'sk_live_abc123' // ✓ What you should do const stripe = process.env.STRIPE_KEY — THE FIX Move all secrets server-side. Use environment variables that never touch the browser. checkvibe.dev 4 MISTAKE of 5 Open Redirects Built Into Auth A redirect param the AI never validated lets attackers send your users from your login page to a phishing clone in one click. // x Unvalidated redirect res.redirect(req.query.next) // ✓ Allowlist paths const safe = ALLOWED.has(req.query.next) res.redirect(safe ? req.query.next : '/') — THE FIX Only redirect to paths on an allowlist. Reject any absolute URL you don't control. checkvibe.dev 5 MISTAKE of 5 Wide Open CORS Policy Letting Everyone In Setting Access-Control-Allow-Origin to "*" means any website can make authenticated requests to your API on behalf of your users. // x AI default Access-Control-Allow-Origin: * // ✓ Explicit whitelist const corsOptions = { origin: ['https://myapp.com'], credentials: true } — THE FIX Whitelist only your own domains. Never use wildcard CORS in production. checkvibe.dev checkvibe Vibe code without the fear checkvibe.dev is the security review built for apps made with Claude Code & Cursor. checkvibe.dev → SCAN YOUR APP FREE TODAY