Vibe Code Detector
👀

You are viewing a Sample Launch Audit Report (Mock Data)

This demonstrates the evidence-backed output format generated by our dual-engine scanner.

Audit Your GitHub Repo ($5)

facebook/reactVerified Target

Scanned 14,850 lines of code across 142 files • Commit: a1b2c3d • Branch: main

Overall Code Quality Grade

Based on AST analysis & AI fingerprinting

Launch Ready With Fixes
A
Satisfactory Baseline
14 action items identified prior to production deploy

Key Security & Code Smells Summary

Critical Supply Chain
0CRITICAL
AI Code Smells
0ATTENTION
Secrets Exposed
0PASSED
Hallucinated Packages
1ACTION REQ

Filter Findings

Audit Your Repository

Get evidence-backed findings and copy-paste fix prompts for your application.

Audit My Repo ($5)

Audit Findings & Remediation(14 items shown)

CRITICAL

Non-Existent Package Dependency (Hallucinated Library)

package.json:24

The AI coding agent imported "@auth/nextjs-stripe-adapter", a package that does not exist on npm register.

Impact: Supply chain risk: Attacker could squat this non-existent package name on npm and execute malicious code during build.

Code Diff & Proposed Remediation
"@auth/nextjs-stripe-adapter": "^1.0.4",
"@stripe/stripe-js": "^3.0.0",
"stripe": "^14.1.0",
ID: find-sec-1
HIGH

Dynamic Eval Execution Sink in API Handler

src/app/api/webhooks/route.ts:42

Dynamic eval() used to parse incoming webhook payload dynamically based on header parameter.

Impact: Remote Code Execution (RCE): Attackers can supply malicious JS payloads in webhook headers.

Code Diff & Proposed Remediation
- const eventData = eval("(" + body.data + ")");
+ const eventData = JSON.parse(body.data);
ID: find-sec-2
MEDIUM

Swallowed Promise Rejection Catch Block

src/lib/llm/client.ts:18

Empty catch block swallowing network and API authentication exceptions without logging.

Impact: Silent failures during checkout and API calls without error context or alerting.

Code Diff & Proposed Remediation
- } catch (err) {}
+ } catch (err) {
+ logger.error("LLM Client call failed", { error: err });
+ throw new APIError("Service unavailable", 503);
+ }
ID: find-slop-1
MEDIUM

Excessive AI Explanatory Comments in Production Code

src/components/CheckoutForm.tsx:8

14 consecutive lines of redundant AI tutorial comments explaining basic React state hooks.

Impact: Bloated bundle payload and noise in code reviews.

Code Diff & Proposed Remediation
- // First, we initialize the useState hook to track customer email input
- // Then, we create a secondary state to handle the loading spinner state during submission
- // Next, we create a function handleFormSubmit that prevents default browser form action
+ // Handle customer checkout submission
ID: find-slop-2
MEDIUM

Generic Identifiers & Naming Overlap

src/utils/helpers.ts:55

Nested variables named data, result, temp, res, and item across 40 lines.

Impact: Decreased code maintainability and high probability of subtle variable scope shadow bugs.

Code Diff & Proposed Remediation
- const data = await res.json();
- const result = data.data.map(item => item.res);
+ const responseData = await httpResponse.json();
+ const processedOrders = responseData.orders.map(order => order.status);
ID: find-slop-3
LOW

Redundant Defensive Null Checking on Non-Nullable Props

src/components/ProductCard.tsx:14

Deep nested ternary checks for properties marked required in TypeScript interface.

Impact: Unnecessary computational overhead and messy component code.

Code Diff & Proposed Remediation
- {product && product.title ? (product.title ? product.title : "") : ""}
+ {product.title}
ID: find-slop-4
MEDIUM

Duplicate Utility Implementations Across Modules

src/lib/formatters.ts:30

Duplicate formatCurrency() helper implemented identically in 3 separate files.

Impact: DRY violation and risk of inconsistent formatting across UI pages.

Code Diff & Proposed Remediation
- function formatPrice(val) { return "$" + val.toFixed(2); }
+ export { formatCurrency } from "@/lib/utils/currency";
ID: find-slop-5
LOW

Unused Import Statements & Hallucinated Types

src/services/analytics.ts:3

8 unused imports including deprecated analytics providers.

Impact: Increases build chunk sizes and slows down TypeScript typecheck compiler.

Code Diff & Proposed Remediation
- import { AnalyticsProvider, EventTracker, MixpanelClient } from "analytics-legacy";
+ import { trackEvent } from "@/lib/analytics";
ID: find-slop-6
MEDIUM

Hardcoded Fallback Secret Placeholders

src/config/env.ts:12

Fallback string "SECRET_KEY_PLACEHOLDER_123" used when process.env.API_SECRET is missing.

Impact: Applications running without environment variables will default to insecure hardcoded secrets.

Code Diff & Proposed Remediation
- const apiSecret = process.env.API_SECRET || "SECRET_KEY_PLACEHOLDER_123";
+ const apiSecret = process.env.API_SECRET || throwEnvError("API_SECRET is required");
ID: find-slop-7
LOW

Unreachable Return Statements & Boilerplate Dead Code

src/hooks/useCart.ts:88

Dead code block following unconditional throw statement.

Impact: Dead code clutter in bundle.

Code Diff & Proposed Remediation
- throw new Error("Failed");
- return { status: "error", cart: null };
+ throw new Error("Failed to load shopping cart");
ID: find-slop-8
HIGH

Unoptimized Heavy Dynamic Imports in Synchronous Loop

src/app/dashboard/page.tsx:105

Heavy icon suite dynamically imported inside a render loop.

Impact: Causes severe client render jank and layout shifts during dashboard load.

Code Diff & Proposed Remediation
- items.map(item => { const Icon = require("lucide-react")[item.icon]; return <Icon />; })
+ import * as Icons from "lucide-react";
+ items.map(item => { const Icon = Icons[item.icon]; return <Icon />; })
ID: find-perf-1
MEDIUM

Missing React.memo on Large Data Table Rows

src/components/OrderTable.tsx:45

100+ order rows re-rendering on every single keystroke in filter search box.

Impact: UI input latency exceeds 150ms on mobile devices.

Code Diff & Proposed Remediation
- export function OrderRow({ order }: OrderRowProps) {
+ export const OrderRow = React.memo(function OrderRow({ order }: OrderRowProps) {
ID: find-perf-2
MEDIUM

Unbounded Database Query Without Pagination Limit

src/app/api/products/route.ts:18

db.product.findMany() called without take or limit parameter.

Impact: Memory crash when product catalog scales beyond 1,000 items.

Code Diff & Proposed Remediation
- const products = await db.product.findMany();
+ const limit = Math.min(Number(req.nextUrl.searchParams.get("limit")) || 20, 100);
+ const products = await db.product.findMany({ take: limit });
ID: find-perf-3
LOW

Uncompressed High-Res Assets in Public Directory

public/images/hero-banner.png:1

Raw 8.4MB PNG asset loaded directly without Next.js Image optimization component.

Impact: Slow LCP metric (3.8s) on 4G mobile connections.

Code Diff & Proposed Remediation
- <img src="/images/hero-banner.png" alt="Banner" />
+ <Image src="/images/hero-banner.png" alt="Banner" width={1200} height={600} priority />
ID: find-perf-4