This codebase has 1 critical issue that must be fixed before going to production.
Scanned main@a1b2c3d · just now · 10 scanners · risk score 58
1
Critical
3
High
5
Medium
2
Low
1
Info
Hardcoded API key committed to source
src/lib/stripe.ts:14
A live Stripe secret key is embedded in the source. AI assistants frequently inline secrets from examples. Rotate the key and load it from an environment variable.
SQL query built with string concatenation
src/db/users.ts:52
User input is concatenated directly into a SQL string, allowing injection. Use parameterized queries.
Hallucinated npm package "react-secure-auth"
package.json:21
This dependency does not exist on the npm registry — a classic AI hallucination and a supply-chain risk if a squatter publishes it.
Missing rate limiting on auth endpoint
src/routes/login.ts:8
The login route has no rate limiting, enabling credential-stuffing attacks.
Connect a GitHub repo and get a real graded report in under five minutes — free.
Scan your repo free