SECURITY CHECKS

How coverage is organized

Three layers run against a target:

1. Browser scan — a headless Chromium session that loads the app, follows links within scope, captures every request and response, and runs the check modules below against what it sees.
2. Check modules — focused probes for specific weakness classes, bundled into every scan.
3. AI agent team — eight specialised agents that plan and execute multi-step attacks on top of the crawl data. See AI security agents.

Everything is then reviewed by an on-call security researcher before the scan is marked complete.

Exposed files and information disclosure

.git directories, .env files, .DS_Store, backup and config files, JavaScript source maps, directory listings, admin login panels, published API docs, sensitive paths hinted by robots.txt, server and framework version headers, SQL error leaks, and mixed content.

Secrets in the client

Hard-coded secrets in inline scripts and bundles, provider keys in page source or HTML comments, auth tokens persisted in localStorage, and tokens passed in URLs. Provider coverage includes AWS, OpenAI, Stripe, GitHub, Slack, Supabase, Firebase, and 25+ others.

Access control and data exposure

Broken object-level authorization (BOLA / IDOR), privileged fields returned to unprivileged users, mass assignment, authorization bypass, user enumeration, and Supabase tables reachable without Row Level Security. These are the findings most often behind a vibe-coded data breach and are weighted accordingly in the risk score.

Headers, CORS, and CSP

Missing or weak Content-Security-Policy, HSTS with a short max-age, missing Cross-Origin-Opener-Policy and Permissions-Policy, CORS reflecting any origin, null origin allowed, wildcard origin combined with credentials, and host-header injection.

Injection and client-side

DOM XSS via location.hash and query parameters, document.write() and dangerouslySetInnerHTML without sanitisation, dynamic eval(), client-side template injection, prototype pollution, CRLF / response-header injection, unsafe postMessage listeners, and SQL, command, and template injection probes from the injection agent.

Sessions, JWT, and OAuth

JWTs with no expiry or more than 30 days of validity, weak or none algorithms, expired tokens still stored, tokens in URLs, missing CSRF tokens, forms that post over HTTP or to third-party origins, insecure ws:// sockets, registration forms with password autocomplete misuse, and OAuth / OIDC start-URL weaknesses.

API-specific

GraphQL introspection enabled, alias-batching without complexity limits, schema leaks, REST endpoints tested for IDOR and mass assignment, and OpenAPI-driven parameter fuzzing when you supply a spec.

Infrastructure and transport

TLS configuration, open redirects, path traversal, SSRF, subdomain takeover, web cache deception, outdated JavaScript libraries, missing Subresource Integrity on third-party CDN scripts, and unsandboxed iframes.

Privacy

Third-party trackers and session-replay tools, fingerprinting APIs and libraries, PII (email, phone, IBAN, SSN) rendered into the DOM, Global Privacy Control ignored, Topics / FLoC not opted out, missing privacy-policy link, and Permissions-Policy wildcards. The Compliance agent maps these to GDPR, PCI-DSS, and cookie-consent expectations.

What is not covered

VibeEval does not read source, does not test internal networks, and does not run destructive payloads by default. Each scan’s on-call note lists explicitly what was out of scope for that pass, and the methodology page describes the limits of black-box testing in more detail.