AI writes code. We find the risks.

"Leaving your master password on a sticky note in your shop window"

We scan your app's public JavaScript bundle for accidentally exposed credentials — OpenAI, Stripe, Supabase, Anthropic, Resend, and more. Any visitor to your site can extract these directly from DevTools.

"A fraudster who walks into your shop, finds an unlocked back room, and starts editing your stock records"

We actively test your app's inputs for XSS (injecting rogue scripts), SQL injection, open redirects, and rate-limit bypasses. These are the same techniques real attackers use — we do it safely and report what we find.

"A staff-only back door that's always unlocked because someone forgot to install the lock"

Next.js and Express API routes that perform sensitive operations — deleting users, reading all orders, sending emails — with no authentication check. Cursor and Lovable generate these patterns constantly without adding auth guards.

"Your bank accepting instructions from a random stranger's website as if they were you"

A wildcard CORS policy on your authenticated endpoints allows malicious websites to make API requests on behalf of your logged-in users without them knowing. AI generators default to open CORS to make development easier — but ship it that way.

"Running a store with broken locks that the manufacturer publicly warned about — but you never read the memo"

We fingerprint your app's tech stack — Next.js version, libraries, frameworks — and cross-reference against the National Vulnerability Database (NVD) for known CVEs. Vibe-coded apps often ship with outdated npm packages that have documented exploits.

"Handing a burglar the full blueprints of your building before they pick the lock"

When GraphQL introspection is left on in production, any visitor can query your API to retrieve a complete map of your schema — every type, field, query, and mutation. This gives attackers a detailed roadmap of your data model.

"A shop with no alarm system, no CCTV, and no locks on the display cases — everything relies on people being honest"

We check for the five critical HTTP security headers: Content-Security-Policy, Strict-Transport-Security (HSTS), X-Frame-Options, X-Content-Type-Options, and Permissions-Policy. Vercel doesn't set these by default; Next.js doesn't either. Most vibe-coded apps ship with zero headers.

"Handing out access badges that don't expire and can be read by anyone nearby"

We inspect your auth and session cookies for three critical flags: HttpOnly (prevents JavaScript from stealing the cookie), Secure (only sent over HTTPS), and SameSite (blocks cross-site submission). AI-generated auth code almost never sets these correctly.

"Publishing your safe combination in the company employee handbook"

Misconfigured deployments sometimes leave .env files, firebase.json, next.config.js, or even .git/config accessible at a public URL. We probe 20+ known paths. This happens more often with Bolt and v0 projects where the deployment step is automated.

"Deleting a document, but forgetting the photocopier's memory still has a copy"

The Wayback Machine and other web archives capture historical snapshots of your app — including past versions that may have contained exposed config files, old API endpoints, or debug pages you've since removed. We query the archive API to surface what was captured.

"Publishing the full architect's drawings of your building — including where all the locks and alarms are"

Next.js apps can accidentally ship source map files (*.js.map) to production, making your original TypeScript source code fully readable by anyone who opens DevTools. All your business logic, API route names, and internal variable names become visible.

"Leaving a complete menu of everything in your safe — with instructions on how to open it — taped to the front window"

Swagger, OpenAPI, and similar auto-generated API docs describe every endpoint, parameter, and data model in your backend. When left publicly accessible in production (/swagger.json, /api-docs, /openapi.json), attackers get a complete map of your entire API surface.

"Writing your server's secrets on the back of every receipt you hand to customers"

Next.js embeds all server-side props inside a public JSON block in every HTML page. When getServerSideProps returns raw database records or config objects, sensitive fields — passwords, API keys, internal IDs — become visible to any user who views the page source.

"Anyone in the world can send letters using your company letterhead — and your recipients have no way to tell the difference"

Without SPF and DMARC DNS records, attackers can send emails that appear to come from your exact domain. Your users receive password-reset requests, payment notifications, or security alerts — all faked — with no technical indicator that they are fraudulent.

"Your shop's 'Open' sign is broken — customers can't tell if you're legitimate or not"

We check your SSL certificate expiry date (warning at 30 days, critical if expired or under 14 days) and verify that plain HTTP traffic is properly redirected to HTTPS. An expired certificate triggers a full-page browser warning that drives nearly all visitors away immediately.

"Your receptionist forwards every caller to whatever number they're told — even strangers claiming to be from HR"

We probe 13 common redirect parameters (?redirect=, ?url=, ?next=, ?goto=, etc.) with an attacker-controlled destination. If your site follows the redirect, attackers craft phishing links that start with your trusted domain but land on a malicious page.

"A bank that lets someone try your PIN an unlimited number of times with no lockout"

We fire 15 concurrent requests at your authentication endpoints (/api/auth/signin, /api/login, etc.) and check whether any are rejected with a 429 Too Many Requests response. Without rate limiting, attackers can test thousands of passwords per minute using breach-database credential lists.

"An intercom that repeats everything you say back out loud — including your access code"

We test for TRACE method support (enables Cross-Site Tracing — stealing HttpOnly cookies via JavaScript) and check whether PUT/DELETE requests on API paths are accepted without authentication. AI-generated backends often skip method-level restrictions entirely.

"Your 'Sorry, we're closed' sign accidentally lists your alarm code and the names of all your staff"

We trigger 404 and error responses, then scan them for JavaScript stack traces, Node.js error codes, database schema details, and framework version strings. Next.js development error pages are detailed by design — but vibe-coded apps frequently ship them to production unchanged.