VibeAudit

VibeAudit · whole-repo audit, findings verified against the code, fix prompt per finding. Free quick scan, $19 deep audit. Scan your own repo →

QUICK SCAN · 2026-09-02

AiyaFun/beacon

58/100
FIX FIRST
90+ ship it
70–89 fix first
<70 not ready

Beacon is a large, unusually well-documented Next.js/Prisma content-ops platform (competitor monitoring, AI agents, publishing, payments) built for both SaaS and self-hosted/appliance deployment. The code shows strong security awareness in most reviewed files (timing-safe token compare, encrypted media, careful RLS/scoping notes), but a leftover debug script (login-tmp.ts) that mints login tickets for an arbitrary tenant is a serious exposure risk if it ships, and several ingest/version endpoints are intentionally open by design and should be double-checked in prod. A deeper audit of the ~1200 unlisted files (especially payment webhook handlers, RLS policies, and agent tool execution) is still needed before launch.

Next.js (App Router)TypeScriptPrisma ORM (SQLite dev / Postgres prod)Node cryptoWeChat Pay integrationTauri desktop appChrome extensionRedis/BullMQ (optional)

9 files reviewed · claude-sonnet-5 · quick scan (highest-risk files only)

Unlock the deep audit

The quick scan read your highest-risk files and found 6 issues.

The top finding is shown in full below so you can check it against your code. The other 5 stay locked. The deep audit reads the whole codebase at high effort, runs a second review of critical/high findings, marks confirmed results, and writes a description, impact, fix and a paste-ready prompt for every finding. Typical result: 8–25 findings, 3–10 minutes.

Loading PayPal…

Secure checkout by PayPal · pay with PayPal balance or any debit/credit card · one-time payment

Have a license key?

Keys come from the 5-pack, or from support after a hosted-checkout purchase. Sign in with GitHub to keep credits on your account.

Send this report to my inbox

The link plus the top finding, so you can find it again after you've fixed things.

Findings (6)

Top finding · shown in full

What's wrong

This script queries for any tenant whose name contains '9520', grabs its first member, and calls issueLocalLoginTicket to mint a working magic-login URL that logs in as that member — printed to stdout. It sits at the repo root (not in a scripts/ or tools/ dir gated from deployment) and has no auth check of its own.

Impact

If this file is ever executed in a production context (accidentally via a build step, a compromised CI job, or a curious operator with DB access), it grants full session takeover of a real tenant/member. Even if never executed, it documents a live account-takeover technique and reveals login-ticket internals; if it were runnable via any exposed endpoint or admin shell it's a full auth bypass.

Fix

Delete this file from the repository entirely, or if it's needed for local dev, move it under a devtools/ directory with a hard-coded requirement of `NODE_ENV!=='production'` and `BEACON_ENV!=='prod'`, gate it behind an explicit env flag, and add it to .gitignore so it can never land in a deployed image.

Paste into Cursor / Claude Code
Delete the file login-tmp.ts from the repository root. If similar functionality is needed for local debugging, recreate it as scripts/dev-login.ts, add `if (process.env.BEACON_ENV === 'prod' || process.env.NODE_ENV === 'production') { throw new Error('dev-only script'); }` at the top of the run() function, and ensure it's excluded from the Docker build context via .dockerignore.

5 more · unlock the deep audit for file, line and fix prompts

medium
/api/health leaks internal status without auth when BEACON_HEALTH_TOKEN unset in prod misconfiguration edge case
src/some/file.ts:42 · security · confidence low
File and line, description, impact, fix and paste-ready prompt are in the deep audit.
medium
apiEnabled() / resolveApiToken never rate-limit or lock out repeated invalid token attempts
src/some/file.ts:42 · security · confidence low
File and line, description, impact, fix and paste-ready prompt are in the deep audit.
medium
CORS wide-open ingest endpoints rely entirely on token header, no rate limiting visible
src/some/file.ts:42 · security · confidence medium
File and line, description, impact, fix and paste-ready prompt are in the deep audit.
low
MediaAsset.data stores raw bytes directly in the primary database with no size cap enforced in the reviewed route
src/some/file.ts:42 · performance · confidence low
File and line, description, impact, fix and paste-ready prompt are in the deep audit.
low
resolveApiToken silently picks the tenant's first workspace/account rather than the one relevant to the call
src/some/file.ts:42 · correctness · confidence medium
File and line, description, impact, fix and paste-ready prompt are in the deep audit.
VibeAudit badge
Add the badge to your README
[![VibeAudit](https://vibeaudit.sh/api/badge/pyi76qbgzz)](https://vibeaudit.sh/a/pyi76qbgzz)