What does a VibeCheck report look like?

Location.

• GET https://sample.example/firebase-rules-open

Proof.

Request: GET https://sample.example/firebase-rules-open

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/firebase-rules-open with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Start from deny-all rules, then open only the paths a signed-in user should see.

{
  "rules": {
    ".read": false,
    ".write": false,
    "users": {
      "$uid": {
        ".read": "auth != null && auth.uid === $uid",
        ".write": "auth != null && auth.uid === $uid"
      }
    }
  }
}

Deploy rules before shipping the client config. Do not leave ".read": true or ".write": true on a parent path.

Location.

• GET https://sample.example/supabase-rls-disabled

Proof.

Request: GET https://sample.example/supabase-rls-disabled

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/supabase-rls-disabled with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Turn on row level security and add a policy before exposing the table to the anon role.

alter table public.users enable row level security;

create policy "read own row"
on public.users
for select
to authenticated
using (auth.uid() = id);

Repeat for every table in the public schema. In the Supabase dashboard, confirm the anon role cannot select rows you would not paste into a public chat.

Location.

• GET https://sample.example/assets/app.js

  Line 12, column 7

  Secret sk_t…0000

Proof.

Request: GET https://sample.example/assets/app.js

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/assets/app.js with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Remove the secret from client code and rotate it now. The old value is public.

1. Revoke or roll the key in the provider dashboard.
2. Keep the new value in a server-only variable. Do not prefix it with NEXT_PUBLIC_ or VITE_.
3. Call the provider from a server route, and return only the data the page needs.

Search the repo for the leaked prefix and for NEXT_PUBLIC_ / VITE_ variables that hold private keys.

Location.

• GET https://sample.example/admin-surface-open

Proof.

Request: GET https://sample.example/admin-surface-open

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/admin-surface-open with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Check the session on the server before returning admin data.

// example server handler
const session = await getSession(request);
if (!session || session.role !== "admin") {
  return new Response("Forbidden", { status: 403 });
}

Do this in the route that reads or writes data, not only in a client component. Return 401 or 403 when the cookie is missing.

Location.

• GET https://sample.example/idor-sequential-ids

Proof.

Request: GET https://sample.example/idor-sequential-ids

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/idor-sequential-ids with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Authorize every object on the server. Do not trust the id in the URL.

const row = await db.order.findFirst({
  where: { id: params.id, userId: session.userId },
});
if (!row) return new Response("Not found", { status: 404 });

Prefer unguessable ids as a backup, but the real fix is the ownership check. A read of someone else's id should look the same as a missing id.

Location.

• GET https://sample.example/public-storage-bucket

Proof.

Request: GET https://sample.example/public-storage-bucket

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/public-storage-bucket with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Turn off public listing and serve files through a short-lived signed URL.

- Supabase: set the bucket to private, then create signed URLs on the server after you check the user.
- Firebase Storage: use rules that require auth, for example
  allow read: if request.auth != null && request.auth.uid == userId;
- S3-style buckets: disable public ACLs and block public access at the account level.

A file can stay downloadable by a direct link you handed to its owner without letting the world list every object.

Location.

• GET https://sample.example/client-side-paywall

Proof.

Request: GET https://sample.example/client-side-paywall

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/client-side-paywall with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Record the purchase on the server and check it there before sending paid data.

const entitled = await db.subscription.findFirst({
  where: { userId: session.userId, status: "active" },
});
if (!entitled) return new Response("Payment required", { status: 402 });

The browser may hide a button, but the API that returns the premium payload has to do the check. Confirm the Stripe webhook updates that row only after a verified event.

Location.

• POST https://sample.example/stripe-webhook-unsigned

Proof.

Request: POST https://sample.example/stripe-webhook-unsigned

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send POST https://sample.example/stripe-webhook-unsigned with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Verify the Stripe-Signature header with the webhook secret before reading the event.

const body = await request.text();
const signature = request.headers.get("stripe-signature");
let event;
try {
  event = stripe.webhooks.constructEvent(body, signature, process.env.STRIPE_WEBHOOK_SECRET);
} catch {
  return new Response("Invalid signature", { status: 400 });
}

Reject missing or invalid signatures with 400. Do not grant access from the success redirect alone.

Location.

• POST https://sample.example/llm-endpoint-open

Proof.

Request: POST https://sample.example/llm-endpoint-open

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send POST https://sample.example/llm-endpoint-open with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Require a session and a rate limit before calling the model.

const session = await getSession(request);
if (!session) return new Response("Unauthorized", { status: 401 });
await rateLimit(`ai:${session.userId}`, { max: 20, windowSeconds: 3600 });

Keep the provider key on the server. Return a generic error when the limit is hit.

Location.

• POST https://sample.example/llm-prompt-leak

Proof.

Request: POST https://sample.example/llm-prompt-leak

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send POST https://sample.example/llm-prompt-leak with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Do not interpolate raw system instructions into a response, and do not trust the model to keep them.

- Authenticate the route and rate-limit it.
- Keep secrets out of the prompt. Pass them as server-side tool calls instead.
- Add a server-side check that refuses to return the system prompt text.
- Treat user text as data, not as a new instruction channel, and filter outputs before they reach the client.

Location.

• GET https://sample.example/exposed-dotenv

Proof.

Request: GET https://sample.example/exposed-dotenv

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/exposed-dotenv with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Remove the file from the public directory and block the path at the host.

# example static host / edge rule
location ~ /\.env { deny all; }

Rebuild without copying .env into the web root. Rotate any secret that was in the file.

Location.

• GET https://sample.example/signup-privileged-role

Proof.

Request: GET https://sample.example/signup-privileged-role

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/signup-privileged-role with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Ignore any role sent by the client. Set roles on the server from an allow-list you control.

const { email, password } = await request.json();
await db.user.create({
  data: { email, passwordHash, role: "member" },
});

Promote someone to admin in a separate server-only action that checks the caller is already an admin.

Location.

• GET https://sample.example/open-redirect

Proof.

Request: GET https://sample.example/open-redirect

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/open-redirect with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Allow only relative paths or an explicit list of hosts.

function safeNext(value: string | null) {
  if (!value || !value.startsWith("/") || value.startsWith("//")) return "/dashboard";
  return value;
}
return redirect(safeNext(nextParam));

Do not pass a full URL from the query string into the Location header.

Location.

• GET https://sample.example/cors-credential-wildcard

Proof.

Request: GET https://sample.example/cors-credential-wildcard

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/cors-credential-wildcard with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Reflect only origins you operate, and avoid combining a wildcard with credentials.

const allowed = new Set(["https://app.example.com"]);
const origin = request.headers.get("origin");
if (origin && allowed.has(origin)) {
  headers.set("Access-Control-Allow-Origin", origin);
  headers.set("Vary", "Origin");
}

Do not send Access-Control-Allow-Credentials: true together with Access-Control-Allow-Origin: *.

Location.

• GET https://sample.example/missing-csp

Proof.

Request: GET https://sample.example/missing-csp

• user-agent: VibeCheckScanner/0.1 (+https://vibecheck.textmatchstudio.com/scanner-info)
• accept: */*

Response.

HTTP 200
content-type: application/json

{"sample":true}

Steps to reproduce.

1. Send GET https://sample.example/missing-csp with no session cookie.
2. The response matches the evidence in this sample finding.

Fix.

Send a policy that limits scripts to your own origin. Start strict and loosen only where a host is required.

Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'

Add the hosts your app actually calls, such as your API and image CDN. Avoid unsafe-inline and unsafe-eval on script-src.