# Vibe Audit Technique

> White-box auditing methodology for AI-generated ('vibe-coded') applications from Lovable, Bolt.new, v0, Cursor, Replit Agent, and Claude Code. Focuses on modern stack misconfigurations (Supabase, Firebase, Next.js, Vercel, Expo).

- Skill: `aeondave/vibe-audit-technique` (Agent Skill, multi-file: 10 files)
- Install (CLI): `npx skillmds@latest add aeondave/vibe-audit-technique`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/vibe-audit-technique/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Web & Frontend
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/vibe-audit-technique

---


# vibe-audit-technique

**Goal**: Identify critical, high-frequency security omissions in modern web/mobile stacks (Next.js, Firebase, Supabase, Vite, Expo) that are typically generated by AI coding assistants (Lovable, Bolt.new, v0, Cursor, Replit Agent, Claude Code).

## When this technique applies

- You have source-code access to a modern web application or mobile app backend.
- The stack relies heavily on BaaS (Backend-as-a-Service) like Supabase, Firebase, or Clerk.
- You are reviewing Next.js Server Actions, tRPC routers, React Server Components, or Expo/React Native apps.
- The repo shows AI-generator fingerprints (Lovable/Bolt/v0/Cursor commit messages, one-shot scaffolded migrations, `.cursor/`, `mcp.json`, `.bolt/`).

## Pair with sibling techniques

- For LLM-assisted taint tracing from source to sink across large repos, drive the pass with `offensive-techniques/source-review-technique/SKILL.md`. This skill supplies the vibe-code sink catalogue; that skill supplies the AI-assisted data-flow discipline.
- Do not re-derive general SAST here.

## The Audit Workflow

### 1. The BaaS Access Control Trap
AI code generators frequently scaffold databases without strict Row-Level Security (RLS). This is the canonical vibe-code failure — see CVE-2025-48757 (Lovable + Supabase, mass RLS-off exposure across hundreds of live apps).
- **Check**: Are tables missing RLS entirely (default state for `public` schema tables in Supabase)?
- **Check**: Are existing RLS policies set to `USING (true)` or `USING (auth.uid() IS NOT NULL)` for convenience?
- **Check**: Cross-tenant IDOR — do policies scope to the row owner / organization, or only to "any authenticated user"?
- **Action**: Load `references/database-security.md`. If ORM (Prisma/Drizzle) or raw SQL is layered on top, also load `references/data-access.md`.

### 2. The Client-Side Secret Leak
AI often pushes server-side secrets to the client to quickly bypass CORS or backend proxy errors.
- **Check**: Grep for `NEXT_PUBLIC_`, `VITE_`, or `EXPO_PUBLIC_`.
- **Check**: Ensure OpenAI, Anthropic, or Stripe secret keys are not bundled in these variables.
- **Action**: Load `references/secrets-and-env.md` and `references/ai-integration.md`.

### 3. Server Action / API Auth Bypass
In Next.js, Server Actions are hidden API endpoints. They must be authenticated individually.
- **Check**: Does the endpoint or Server Action assume the user is trusted simply because middleware exists? Middleware is often bypassed or overly permissive.
- **Action**: Load `references/authentication.md`.

### 4. Billing and Rate Limits
AI assistants build features, not defenses.
- **Check**: Are AI query routes (e.g., text generation, image generation) protected by rate limits?
- **Check**: Are payment webhooks properly verifying signatures?
- **Action**: Load `references/rate-limiting.md` and `references/payments.md`.

### 5. Mobile Bundle & Deployment Surface
Expo/React Native apps generated by AI ship with embedded secrets and insecure storage. Vercel/Netlify preview and prod configs are often mixed.
- **Check**: Any `EXPO_PUBLIC_*` referencing a secret key; use of `AsyncStorage` for tokens; deep links used for auth.
- **Check**: Preview deployments sharing production credentials; source maps or `.git/` exposed in prod; permissive CORS.
- **Action**: Load `references/mobile.md` for the bundle surface, `references/deployment.md` for the hosting surface.

## Quality Gates

- **Context matters**: A leaked `NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY` is not a vulnerability (it is meant to be public). A leaked `STRIPE_SECRET_KEY` is critical. Verify before reporting.
- **Do not report generic 'missing headers'**: Focus strictly on the critical gaps caused by "vibe-coding" (Direct DB exposure, unauthorized server actions, secret leakage).