← Back to Labs

Vibe Coding Vulnerability Audit

Trace how AI-assisted code introduces hidden service-role leaks, unvalidated inputs, missing RLS policies, and race conditions

CATEGORY: Credential ExposureCWE-552 / OWASP A01:2021ENV LEAKExposed KeyFull Admin AccessExtracts KeyClient Bundle.next/static/js (Public)Service Role KeySUPABASE_SERVICE_ROLE_...Supabase DBBypasses All RLS AuthAttacker ReconExtracts key from windowAUDIT CODE TRACEexport const supabase = createClient(URL, process.env.NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY!)
STEP 1 OF 6

Service Role Key Shipped to Browser

AI code generators often mix server environment variables into client bundles, exposing administrative database keys like SUPABASE_SERVICE_ROLE_KEY directly in browser JavaScript assets.

Arrow keys to navigate · R to reset

Tap dots to jump to any step

Read the full article →Take the quiz →