← Back to Labs

Vibe-code security audit

Work through a security review of a hurried Supabase + Next.js prototype. Close findings one by one and watch the risk score improve.

security score0critical riskfindings (10 open / 0 fixed)Service role key in ..Row Level Security d..Passwords stored as ..JWT stored in localS..No input validation ..Hardcoded admin emai..No rate limiting on ..No Content Security ..CORS wildcard with c..Dependencies 18 mont..criticalhighmediumlowfixed
criticalService role key in browser bundle

A database admin key is being shipped to every browser that loads the page. A visitor who inspects the bundle can use it to query or modify data far beyond what a normal client should ever reach.

recommended fix: Move all admin database calls to a server route. Only the public anon key belongs in the browser.

Fresh audit of a hurried Supabase + Next.js prototype. Ten findings are open. Close them one by one and watch the risk score improve.

Shortcuts: 1-9, 0 toggle finding · F fix next · A fix all · X reset
Tap a finding to toggle. Use Fix All to see the target state.
Read the full article →Take the quiz →