VibeAudit · whole-repo audit, findings verified against the code, fix prompt per finding. Free quick scan, $19 deep audit. Scan your own repo →
QUICK SCAN · 2026-09-02
AiyaFun/beacon
70–89 fix first
<70 not ready
Beacon is a large, unusually well-documented Next.js/Prisma content-ops platform (competitor monitoring, AI agents, publishing, payments) built for both SaaS and self-hosted/appliance deployment. The code shows strong security awareness in most reviewed files (timing-safe token compare, encrypted media, careful RLS/scoping notes), but a leftover debug script (login-tmp.ts) that mints login tickets for an arbitrary tenant is a serious exposure risk if it ships, and several ingest/version endpoints are intentionally open by design and should be double-checked in prod. A deeper audit of the ~1200 unlisted files (especially payment webhook handlers, RLS policies, and agent tool execution) is still needed before launch.
9 files reviewed · claude-sonnet-5 · quick scan (highest-risk files only)
Unlock the deep audit
The quick scan read your highest-risk files and found 6 issues.
The top finding is shown in full below so you can check it against your code. The other 5 stay locked. The deep audit reads the whole codebase at high effort, runs a second review of critical/high findings, marks confirmed results, and writes a description, impact, fix and a paste-ready prompt for every finding. Typical result: 8–25 findings, 3–10 minutes.
Secure checkout by PayPal · pay with PayPal balance or any debit/credit card · one-time payment
Have a license key?
Keys come from the 5-pack, or from support after a hosted-checkout purchase. Sign in with GitHub to keep credits on your account.
Findings (6)
Top finding · shown in full
This script queries for any tenant whose name contains '9520', grabs its first member, and calls issueLocalLoginTicket to mint a working magic-login URL that logs in as that member — printed to stdout. It sits at the repo root (not in a scripts/ or tools/ dir gated from deployment) and has no auth check of its own.
If this file is ever executed in a production context (accidentally via a build step, a compromised CI job, or a curious operator with DB access), it grants full session takeover of a real tenant/member. Even if never executed, it documents a live account-takeover technique and reveals login-ticket internals; if it were runnable via any exposed endpoint or admin shell it's a full auth bypass.
Delete this file from the repository entirely, or if it's needed for local dev, move it under a devtools/ directory with a hard-coded requirement of `NODE_ENV!=='production'` and `BEACON_ENV!=='prod'`, gate it behind an explicit env flag, and add it to .gitignore so it can never land in a deployed image.
Delete the file login-tmp.ts from the repository root. If similar functionality is needed for local debugging, recreate it as scripts/dev-login.ts, add `if (process.env.BEACON_ENV === 'prod' || process.env.NODE_ENV === 'production') { throw new Error('dev-only script'); }` at the top of the run() function, and ensure it's excluded from the Docker build context via .dockerignore.5 more · unlock the deep audit for file, line and fix prompts