ShipSecurely
Ways vibe-coded apps get hacked
Critical means someone can reach other people's data or your money without much skill. High means a real path that takes a bit more work. Medium means a missing control that makes other bugs worse, or a launch gap that is not itself an exploit.
Last updated
22 of 22 issues
- criticalAccess control
Auth checked only in the UI
Hiding a button or a page does not stop a request. The server, the database policy, or both have to reject it.
Next.js · Supabase · Firebase · Vercel
- criticalSecrets
Exposed .env files and debug endpoints
A public .env, a /api/debug route, or a client bundle that prints config hands your secrets to anyone who asks.
Next.js · Vercel · Supabase
- criticalDatabase
Firebase rules left open
Firestore or Storage rules that allow any read and write make the database public. The client SDK will do whatever the rules allow.
Firebase · Next.js
- criticalAccess control
IDOR: reading or changing someone else's data
The request carries an id, and the server fetches that id without checking that it belongs to the signed-in user.
Next.js · Supabase · Firebase
- criticalSecrets
Keys committed to GitHub
A key in a commit is copied to every clone and to GitHub's history. Deleting the file in a new commit does not remove it.
GitHub · Supabase · Vercel · Next.js
- criticalAI
No cap on LLM API spend
A model route with your key and no limit is a meter anyone can run. One script can spend a month of budget in an afternoon.
Next.js · Vercel
- criticalDatabase
Open storage buckets
A public bucket, or a storage policy of allow-all, lets anyone with the URL read files other users uploaded.
Supabase · Firebase · Vercel
- criticalSecrets
Secret keys shipped in the frontend
A Supabase secret key, Stripe secret key, or model API key in the browser bundle is public. Anyone can copy it and use it as your server.
Supabase · Next.js · Vercel · Stripe · Firebase
- criticalAccess control
Server Actions with no auth check
A Server Action is a public POST. 'use server' does not mean only your button can call it.
Next.js · Supabase · Vercel
- criticalDatabase
Supabase tables without row level security
Tables in the public schema are reachable through the Supabase API. With row level security off, the publishable key is enough to read and change every row.
Supabase · Postgres · Next.js
- criticalPayments
The client sets the price, role, or plan
If the browser can send amount, plan, or role and the server saves it, users will send the values they want.
Stripe · Next.js · Supabase · Firebase
- criticalPayments
Unverified Stripe webhooks
A webhook is a public URL. If you trust the JSON without checking Stripe's signature, anyone can tell your app that a payment succeeded.
Stripe · Next.js · Vercel
- highConfiguration
CORS wide open
Reflecting any website's Origin and allowing credentials means that website can call your API as the logged-in user.
Next.js · Supabase · Firebase · Vercel
- highInjection
Cross-site scripting (XSS)
User content rendered as HTML runs in your origin. It can read that user's data and call your API as them.
Next.js · Supabase · Vercel
- highAccess control
No rate limiting on auth or paid API routes
Login, password reset, and any route that calls a paid API will accept as many requests as an attacker sends, until the bill or the user list gives out.
Next.js · Vercel · Supabase · Stripe
- highAI
Prompt injection in LLM features
Text you feed a model, including user messages and documents it reads, can contain instructions. If the model can call tools, those instructions can become actions.
Next.js · Supabase
- highInjection
SQL injection
User input glued into a SQL string can change the query. The database then runs the attacker's statement with your connection's privileges.
Supabase · Next.js · Postgres
- highInjection
Unsafe file uploads
An upload that trusts the browser's file type, keeps the original name, or serves the file from your site can become stored XSS or a malware host.
Supabase · Firebase · Next.js · Vercel
- highAccess control
Weak password reset
A reset flow that uses a short code, a guessable link, or a client-only check lets someone take the account without the password.
Supabase · Firebase · Next.js
- mediumPrivacy
Missing privacy policy and terms
If you collect accounts, emails, or payments, you need a page that says what you collect and a page that says the rules of the product. This is not legal advice.
Next.js · Supabase · Vercel · Stripe
- mediumConfiguration
Missing security headers
Headers tell the browser not to sniff content, not to load you in a frame, and which scripts are allowed. They limit damage, and they do not replace auth.
Next.js · Vercel
- mediumConfiguration
Outdated dependencies
A lockfile full of old packages is a pile of known bugs you have not looked at. Some are security fixes and some are noise, so you still have to look.
GitHub · Next.js · Vercel