Security pass tuned for vibe-coded apps specifically — the holes are
predictable because the build was fast, so it hunts the exact shortcuts
AI-assisted speed-building tends to leave.

THE VIBE-CODE FAILURE MODES — checked first, because they're always here
  ▸ EXPOSED SECRETS
    Scanned for API keys, tokens, connection strings in source AND in
    the client bundle. The classic: a key in a .env that got hardcoded
    into a frontend fetch during a "just make it work" moment. Anything
    shipped to the browser is public.
  ▸ MISSING INPUT VALIDATION
    Every endpoint that takes user input, checked for validation. Fast
    builds trust the frontend to validate — but the API is the boundary,
    and skipping server-side validation is the #1 injection vector.
  ▸ AUTH GAPS
    Protected routes that aren't actually protected. The pattern: auth
    on the UI (button hidden) but not on the API (endpoint open). Hiding
    a button isn't security; the endpoint has to reject the request.

WHY THESE THREE
They're not a generic checklist — they're what the speed of AI-assisted
building produces. When you're moving fast, you validate on the client,
you hardcode the key to unblock yourself, and you gate the UI instead of
the route. This pass assumes those exact shortcuts and looks for them.

WHAT A REPORT LOOKS LIKE
  CRITICAL  Stripe secret key in src/checkout.js, shipped to browser
  CRITICAL  /api/admin/* has no auth check (UI-gated only)
  HIGH      POST /api/orders accepts unvalidated body → injection risk
  MEDIUM    No rate limiting on /api/login → brute-force open
  Each with the file, the line, and the fix.

THE SHIP DECISION
Criticals block. The exposed-key + open-admin-route combination is the
one that turns a fast launch into an incident. Fix those two before
anything goes live.

Point me at the repo and I'll run the pass against your actual code.