AI-generated code makes the same mistakes. This is the checklist we run on every vibe-coded app we test. The five flaw classes, in the order we prove them most often.
1. Broken auth and access control
- Tenant isolation — can any logged-in user read any organization's data by changing the ID?
- Object authorization — is every API route authorized per-object, not just per-endpoint?
- Session handling — are tokens validated on expiry, signature, and audience?
- Privilege escalation — can a regular user reach admin-only routes by guessing the URL?
2. Injection
- SQL injection — string concatenation in queries, ORM misuse.
- Command injection — user input passed to shell or template engines.
- Header injection — Host, X-Forwarded-For, or Referer poisoning.
3. Exposed secrets in the shipped bundle
- API keys — are keys readable in the client-visible JavaScript?
- Tokens — are access tokens baked into the bundle?
- Passwords — are credentials in the shipped code?
- Internal URLs — are private endpoints exposed in the bundle?
4. Insecure defaults
- Debug routes — is `/debug`, `/metrics`, or `/health` exposing internals?
- Open admin panels — is the admin UI reachable without auth?
- Permissive CORS — is `Access-Control-Allow-Origin: *` set with credentials?
- Missing rate limits — are login and OTP endpoints rate-limited?
5. Dependency and scaffold flaws
- Vulnerable starter template — did the scaffold pin a vulnerable package?
- Default credentials — are the scaffold's default passwords still set?
- Static file exposure — is `.env` or config served as a static file?
Muster runs this checklist on every deploy, proves each finding with the exact request, and hands you the fix. First scan free, no credit card to start, first findings in ~10 minutes.