AI-generated code makes the same mistakes. This is the checklist we run on every vibe-coded app we test. The five flaw classes, in the order we prove them most often.
1. Broken auth and access control
- Tenant isolation — can any logged-in user read any organization's data by changing the ID?
- Object authorization — is every API route authorized per-object, not just per-endpoint?
- Session handling — are tokens validated on expiry, signature, and audience?
- Privilege escalation — can a regular user reach admin-only routes by guessing the URL?
2. Injection
- SQL injection — string concatenation in queries, ORM misuse.
- Command injection — user input passed to shell or template engines.
- Header injection — Host, X-Forwarded-For, or Referer poisoning.
3. Exposed secrets in the shipped bundle
- API keys — are keys readable in the client-visible JavaScript?
- Tokens — are access tokens baked into the bundle?
- Passwords — are credentials in the shipped code?
- Internal URLs — are private endpoints exposed in the bundle?
4. Insecure defaults
- Debug routes — is `/debug`, `/metrics`, or `/health` exposing internals?
- Open admin panels — is the admin UI reachable without auth?
- Permissive CORS — is `Access-Control-Allow-Origin: *` set with credentials?
- Missing rate limits — are login and OTP endpoints rate-limited?
5. Dependency and scaffold flaws
- Vulnerable starter template — did the scaffold pin a vulnerable package?
- Default credentials — are the scaffold's default passwords still set?
- Static file exposure — is `.env` or config served as a static file?
Muster runs this checklist on every deploy, proves each finding with the exact request, and hands you the fix. Start free, first findings in ~10 minutes.