demo-app (deliberately vulnerable sample)

# VibePreflight Security Report

- **Repo:** `demo-app (deliberately vulnerable sample)`
- **Generated:** 2026-10-19 09:06 EDT
- **Tools:** gitleaks=yes, semgrep=yes, npm=yes, osv-scanner=yes

## Summary
Critical: **4** · High: **12** · Medium: **4** · Low: **0** · Info: **0**

> **Disclaimer:** Automated best-effort review using open-source tools and AI. Not a penetration test, audit, or guarantee of security. May miss issues or produce false positives. No application code is executed; we use read-only analysis. You are responsible for your application.

## Findings
### 1. [CRITICAL] Possible service_role key in client code
- **Source:** supabase-heuristic
- **Detail:** `src/client.tsx` mentions service_role near client markers.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Move the Supabase service_role key to server-only code. Client code may only use the anon key via NEXT_PUBLIC_SUPABASE_ANON_KEY.

### 2. [CRITICAL] Secret: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
- **Source:** gitleaks
- **Detail:** File `.env` line 1 (rule `generic-api-key`). Match redacted.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Remove the hardcoded secret from this file and from git history (rotate the key). Load it from an environment variable. Update `.env.example` with a placeholder only. Confirm it is not exposed via NEXT_PUBLIC_* or client bundles.

### 3. [CRITICAL] Secret: Found a Stripe Access Token, posing a risk to payment processing services and sensitive financial data.
- **Source:** gitleaks
- **Detail:** File `src/server.js` line 6 (rule `stripe-access-token`). Match redacted.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Remove the hardcoded secret from this file and from git history (rotate the key). Load it from an environment variable. Update `.env.example` with a placeholder only. Confirm it is not exposed via NEXT_PUBLIC_* or client bundles.

### 4. [CRITICAL] Table `profiles` created without ENABLE ROW LEVEL SECURITY
- **Source:** supabase-heuristic
- **Detail:** Migrations create this table but never enable RLS in the scanned SQL.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Append `ALTER TABLE public.profiles ENABLE ROW LEVEL SECURITY;` and add SELECT/INSERT/UPDATE/DELETE policies scoped to auth.uid() on the ownership column. Do not use USING (true).

### 5. [HIGH] Code: ajinabraham.njsscan.exec.exec_os_command.generic_os_command_exec
- **Source:** semgrep
- **Detail:** User controlled data in 'child_process.exec()' can result in Remote OS Command Execution. (`src/server.js`:11)
- **Fix prompt (paste into Cursor / Claude Code):**
  > Open `src/server.js` around line 11. Fix the issue described: User controlled data in 'child_process.exec()' can result in Remote OS Command Execution.. Prefer parameterized queries, auth checks, and no hardcoded secrets. Explain the change briefly when done.

### 6. [HIGH] Code: ajinabraham.njsscan.generic.hardcoded_secrets.node_secret
- **Source:** semgrep
- **Detail:** A hardcoded secret is identified. Store it properly in an environment variable. (`src/server.js`:6)
- **Fix prompt (paste into Cursor / Claude Code):**
  > Open `src/server.js` around line 6. Fix the issue described: A hardcoded secret is identified. Store it properly in an environment variable.. Prefer parameterized queries, auth checks, and no hardcoded secrets. Explain the change briefly when done.

### 7. [HIGH] Code: generic.secrets.security.detected-stripe-api-key.detected-stripe-api-key
- **Source:** semgrep
- **Detail:** Stripe API Key detected (`src/server.js`:6)
- **Fix prompt (paste into Cursor / Claude Code):**
  > Open `src/server.js` around line 6. Fix the issue described: Stripe API Key detected. Prefer parameterized queries, auth checks, and no hardcoded secrets. Explain the change briefly when done.

### 8. [HIGH] Code: scanner.rules.vp-express-unauth-sensitive-route
- **Source:** semgrep
- **Detail:** Sensitive route "/admin" has no authentication middleware. Anyone can call it. (`src/server.js`:14)
- **Fix prompt (paste into Cursor / Claude Code):**
  > Open `src/server.js` around line 14. Fix the issue described: Sensitive route "/admin" has no authentication middleware. Anyone can call it.. Prefer parameterized queries, auth checks, and no hardcoded secrets. Explain the change briefly when done.

### 9. [HIGH] Code: scanner.rules.vp-nextjs-route-handler-no-auth
- **Source:** semgrep
- **Detail:** Next.js route handler GET under an admin/api path has no visible auth/session check. (`app/api/admin/users/route.ts`:1)
- **Fix prompt (paste into Cursor / Claude Code):**
  > Open `app/api/admin/users/route.ts` around line 1. Fix the issue described: Next.js route handler GET under an admin/api path has no visible auth/session check.. Prefer parameterized queries, auth checks, and no hardcoded secrets. Explain the change briefly when done.

### 10. [HIGH] Permissive RLS policy USING (true) / WITH CHECK (true)
- **Source:** supabase-heuristic
- **Detail:** Found in `supabase/migrations/001_init.sql`
- **Fix prompt (paste into Cursor / Claude Code):**
  > Replace USING (true) policies with checks like `user_id = auth.uid()`. USING (true) lets any role that matches the policy read/write all rows.

### 11. [HIGH] Vulnerable dependency: body-parser
- **Source:** dependencies
- **Detail:** body-parser vulnerable to denial of service when url encoding is enabled. Advisories: GHSA-qwcr-r2fm-qrc7, GHSA-v422-hmwv-36x6. Found by: OSV, npm audit.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Upgrade `body-parser` to a version without these advisories (try `npm audit fix`; if it is a transitive dependency, upgrade the parent package). Re-run tests afterwards.

### 12. [HIGH] Vulnerable dependency: express
- **Source:** dependencies
- **Detail:** express vulnerable to XSS via response.redirect(). Advisories: GHSA-qw6h-vgh9-j6wx, GHSA-rv95-896h-c2vc. Found by: OSV, npm audit.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Upgrade `express` to a version without these advisories (try `npm audit fix`; if it is a transitive dependency, upgrade the parent package). Re-run tests afterwards.

### 13. [HIGH] Vulnerable dependency: lodash
- **Source:** dependencies
- **Detail:** Command Injection in lodash. Advisories: GHSA-29mw-wpgm-hmr9, GHSA-35jh-r3h4-6jhm, GHSA-f23m-r3pf-42rh, GHSA-p6mc-m468-83gw, GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg. Found by: OSV, npm audit.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Upgrade `lodash` to a version without these advisories (try `npm audit fix`; if it is a transitive dependency, upgrade the parent package). Re-run tests afterwards.

### 14. [HIGH] Vulnerable dependency: path-to-regexp
- **Source:** dependencies
- **Detail:** path-to-regexp outputs backtracking regular expressions. Advisories: GHSA-37ch-88jc-xwx2, GHSA-9wv6-86v2-598j, GHSA-rhx6-c78j-4q9w. Found by: OSV, npm audit.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Upgrade `path-to-regexp` to a version without these advisories (try `npm audit fix`; if it is a transitive dependency, upgrade the parent package). Re-run tests afterwards.

### 15. [HIGH] Vulnerable dependency: qs
- **Source:** dependencies
- **Detail:** qs vulnerable to Prototype Pollution. Advisories: GHSA-4mjr-xmp4-gh2g, GHSA-6rw7-vpxm-498p, GHSA-hrpp-h998-j3pp, GHSA-w7fw-mjwx-w883. Found by: OSV, npm audit.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Upgrade `qs` to a version without these advisories (try `npm audit fix`; if it is a transitive dependency, upgrade the parent package). Re-run tests afterwards.

### 16. [HIGH] createClient with service_role
- **Source:** supabase-heuristic
- **Detail:** `src/client.tsx`
- **Fix prompt (paste into Cursor / Claude Code):**
  > Use the anon key on the client; service_role only in Route Handlers / Server Actions.

### 17. [MEDIUM] Possibly public storage bucket
- **Source:** supabase-heuristic
- **Detail:** `storage.json` sets public: true near storage/bucket config.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Confirm the bucket must be public. If not, set public: false and use signed URLs.

### 18. [MEDIUM] Vulnerable dependency: cookie
- **Source:** dependencies
- **Detail:** cookie accepts cookie name, path, and domain with out of bounds characters. Advisories: GHSA-pxg6-pf52-xh8x. Found by: OSV, npm audit.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Upgrade `cookie` to a version without these advisories (try `npm audit fix`; if it is a transitive dependency, upgrade the parent package). Re-run tests afterwards.

### 19. [MEDIUM] Vulnerable dependency: send
- **Source:** dependencies
- **Detail:** send vulnerable to template injection that can lead to XSS. Advisories: GHSA-m6fv-jmcg-4jfg. Found by: OSV, npm audit.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Upgrade `send` to a version without these advisories (try `npm audit fix`; if it is a transitive dependency, upgrade the parent package). Re-run tests afterwards.

### 20. [MEDIUM] Vulnerable dependency: serve-static
- **Source:** dependencies
- **Detail:** serve-static vulnerable to template injection that can lead to XSS. Advisories: GHSA-cm22-4g7w-348p. Found by: OSV, npm audit.
- **Fix prompt (paste into Cursor / Claude Code):**
  > Upgrade `serve-static` to a version without these advisories (try `npm audit fix`; if it is a transitive dependency, upgrade the parent package). Re-run tests afterwards.

## Next steps
1. Fix Critical and High first.
2. Paste each fix prompt into your AI coding tool.
3. Re-run this scan or buy a re-scan.
4. Install the free VibePreflight Guardrail Starter Pack to prevent regressions.