aeondave/vibe-audit-technique

vibe-audit-technique

Goal: Identify critical, high-frequency security omissions in modern web/mobile stacks (Next.js, Firebase, Supabase, Vite, Expo) that are typically generated by AI coding assistants (Lovable, Bolt.new, v0, Cursor, Replit Agent, Claude Code).

When this technique applies

• You have source-code access to a modern web application or mobile app backend.
• The stack relies heavily on BaaS (Backend-as-a-Service) like Supabase, Firebase, or Clerk.
• You are reviewing Next.js Server Actions, tRPC routers, React Server Components, or Expo/React Native apps.
• The repo shows AI-generator fingerprints (Lovable/Bolt/v0/Cursor commit messages, one-shot scaffolded migrations, .cursor/, mcp.json, .bolt/).

Pair with sibling techniques

• For LLM-assisted taint tracing from source to sink across large repos, drive the pass with offensive-techniques/source-review-technique/SKILL.md. This skill supplies the vibe-code sink catalogue; that skill supplies the AI-assisted data-flow discipline.
• Do not re-derive general SAST here.

The Audit Workflow

1. The BaaS Access Control Trap

AI code generators frequently scaffold databases without strict Row-Level Security (RLS). This is the canonical vibe-code failure — see CVE-2025-48757 (Lovable + Supabase, mass RLS-off exposure across hundreds of live apps).

• Check: Are tables missing RLS entirely (default state for public schema tables in Supabase)?
• Check: Are existing RLS policies set to USING (true) or USING (auth.uid() IS NOT NULL) for convenience?
• Check: Cross-tenant IDOR — do policies scope to the row owner / organization, or only to "any authenticated user"?
• Action: Load references/database-security.md. If ORM (Prisma/Drizzle) or raw SQL is layered on top, also load references/data-access.md.

2. The Client-Side Secret Leak

AI often pushes server-side secrets to the client to quickly bypass CORS or backend proxy errors.

• Check: Grep for NEXT_PUBLIC_, VITE_, or EXPO_PUBLIC_.
• Check: Ensure OpenAI, Anthropic, or Stripe secret keys are not bundled in these variables.
• Action: Load references/secrets-and-env.md and references/ai-integration.md.

3. Server Action / API Auth Bypass

In Next.js, Server Actions are hidden API endpoints. They must be authenticated individually.

• Check: Does the endpoint or Server Action assume the user is trusted simply because middleware exists? Middleware is often bypassed or overly permissive.
• Action: Load references/authentication.md.

4. Billing and Rate Limits

AI assistants build features, not defenses.

• Check: Are AI query routes (e.g., text generation, image generation) protected by rate limits?
• Check: Are payment webhooks properly verifying signatures?
• Action: Load references/rate-limiting.md and references/payments.md.

5. Mobile Bundle & Deployment Surface

Expo/React Native apps generated by AI ship with embedded secrets and insecure storage. Vercel/Netlify preview and prod configs are often mixed.

• Check: Any EXPO_PUBLIC_* referencing a secret key; use of AsyncStorage for tokens; deep links used for auth.
• Check: Preview deployments sharing production credentials; source maps or .git/ exposed in prod; permissive CORS.
• Action: Load references/mobile.md for the bundle surface, references/deployment.md for the hosting surface.

Quality Gates

• Context matters: A leaked NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY is not a vulnerability (it is meant to be public). A leaked STRIPE_SECRET_KEY is critical. Verify before reporting.
• Do not report generic 'missing headers': Focus strictly on the critical gaps caused by "vibe-coding" (Direct DB exposure, unauthorized server actions, secret leakage).