Critical·Security
Open redirect in OAuth callback
Fixed using ShipProof
app/auth/callback/route.ts
The next parameter was not validated, allowing attackers to redirect users to malicious sites after login.
Full Scan · Fresh discovery
Built with Cursor · Scanned July 2, 2026 · completed
Needs Attention
Improved from 0 after fixing 7 issues
5 Critical
Fix before launch
2 Warnings
Fix soon, not urgent
1 Info
Optional improvements
7 of 8 issues marked as fixed
Fixed using ShipProof
app/auth/callback/route.ts
The next parameter was not validated, allowing attackers to redirect users to malicious sites after login.
Fixed using ShipProof
app/api/scan/analyze/route.ts
Anyone could spam the scan endpoint and drain Claude API credits with no limit.
Fixed using ShipProof
app/api/auth/route.ts
Three stub routes had no auth checks, exposing unnecessary API surface to anyone.
Fixed using ShipProof
lib/auth.ts
getGitHubToken used getSession() without server-side JWT verification first.
Fixed using ShipProof
next.config.mjs
Missing CSP, HSTS, X-Frame-Options and X-Content-Type-Options headers.
next.config.mjs
unsafe-inline in CSP negates XSS protection. Requires nonce implementation which is complex in Next.js.
Known limitation of Next.js — we're working on a proper nonce implementation
Fixed using ShipProof
supabase/migrations/
scans.user_id and scan_results.scan_id had no indexes, causing full table scans.
Fixed using ShipProof
package.json
GHSA-fx2h-pf6j-xcff: Known vulnerability in vite 8.0.12.