aeondave/vibe-audit-technique

vibe-audit-technique

Goal: Identify critical, high-frequency security omissions in modern web stacks (Next.js, Firebase, Supabase, VITE) that are typically generated by AI coding assistants.

When this technique applies

• You have source-code access to a modern web application or mobile app backend.
• The stack relies heavily on BaaS (Backend-as-a-Service) like Supabase, Firebase, or Clerk.
• You are reviewing Next.js Server Actions, tRPC routers, or React Server Components.

The Audit Workflow

1. The BaaS Access Control Trap

AI code generators frequently scaffold databases without strict Row-Level Security (RLS).

• Check: Are tables missing RLS entirely?
• Check: Are existing RLS policies set to USING (true) for convenience?
• Action: Load references/database-security.md.

2. The Client-Side Secret Leak

AI often pushes server-side secrets to the client to quickly bypass CORS or backend proxy errors.

• Check: Grep for NEXT_PUBLIC_, VITE_, or EXPO_PUBLIC_.
• Check: Ensure OpenAI, Anthropic, or Stripe secret keys are not bundled in these variables.
• Action: Load references/secrets-and-env.md and references/ai-integration.md.

3. Server Action / API Auth Bypass

In Next.js, Server Actions are hidden API endpoints. They must be authenticated individually.

• Check: Does the endpoint or Server Action assume the user is trusted simply because middleware exists? Middleware is often bypassed or overly permissive.
• Action: Load references/authentication.md.

4. Billing and Rate Limits

AI assistants build features, not defenses.

• Check: Are AI query routes (e.g., text generation, image generation) protected by rate limits?
• Check: Are payment webhooks properly verifying signatures?
• Action: Load references/rate-limiting.md and references/payments.md.

Quality Gates

• Context matters: A leaked NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY is not a vulnerability (it is meant to be public). A leaked STRIPE_SECRET_KEY is critical. Verify before reporting.
• Do not report generic 'missing headers': Focus strictly on the critical gaps caused by "vibe-coding" (Direct DB exposure, unauthorized server actions, secret leakage).