CtrlK
BlogDocsLog inGet started
Tessl Logo
PluginPublic

vibecure/vibecure

Scans Node.js/Express backends for paid endpoint abuse and billing attacks (EDoS). 15 checks across SMS, Email, and AI/LLM domains. Finds uncapped AI costs, missing rate limits, bot protection, user quotas, SMS toll fraud, credential leaks. Detects Twilio, SendGrid, OpenAI + 19 more providers. Use when user asks to scan, audit, review security, or mentions VibeCure.

86

2.40x
Quality

84%

Does it follow best practices?

Impact

96%

2.40x

Average score across 3 eval scenarios

SecuritybySnyk

Passed

No findings from the security scan

Overview
Quality
Evals
Security
Files

CREDENTIAL-SAFETY.mdreferences/

Credential Safety Classification

When evaluating hardcoded credentials, distinguish between public credentials (designed for client-side embedding) and secret credentials (must use environment variables).

Decision rule: If the credential grants access to a paid API or allows server-side operations, it is SECRET. If the vendor explicitly designs it for browser/client embedding, it is PUBLIC.

NON-SECRET (Do Not Flag)

ServiceCredentialEnv VarWhy Safe
SupabaseURLSUPABASE_URLPublic endpoint
ClerkPublishable KeyCLERK_PUBLISHABLE_KEYDesigned for frontend — pk_live_* / pk_test_*
Auth0DomainAUTH0_DOMAINTenant identifier
Auth0Client IDAUTH0_CLIENT_IDOAuth public identifier
FirebaseProject IDFIREBASE_PROJECT_IDIdentifier, access controlled by Security Rules
CognitoClient IDCOGNITO_CLIENT_IDOAuth public identifier
CognitoUser Pool IDCOGNITO_USER_POOL_IDResource identifier
AWSRegionAWS_REGIONInfrastructure metadata
SMTPHost / Port / FromSMTP_HOST, SMTP_PORT, SMTP_FROMServer config, not secrets
SendGridFrom EmailSENDGRID_FROM_EMAILSender identity

SECRET — Must Use Env Vars (Always Flag)

ServiceCredentialEnv VarFormat
TwilioAccount SIDTWILIO_ACCOUNT_SIDAC + 32 hex
TwilioAuth TokenTWILIO_AUTH_TOKEN32 hex
SendGridAPI KeySENDGRID_API_KEYSG. + base64
OpenAIAPI KeyOPENAI_API_KEYsk-proj- + ~130 alphanumeric
AnthropicAPI KeyANTHROPIC_API_KEYsk-ant- + alphanumeric
VonageAPI Key + SecretVONAGE_API_KEY, VONAGE_API_SECRET8 alphanum / 16 hex
MessageBirdAccess KeyMESSAGEBIRD_ACCESS_KEYlive_ + 32+ hex
PlivoAuth ID + TokenPLIVO_AUTH_ID, PLIVO_AUTH_TOKENMA + 18 alphanum / base64
ClerkSecret KeyCLERK_SECRET_KEYsk_live_* or sk_test_*
Auth0Client SecretAUTH0_CLIENT_SECRET64 alphanumeric
Auth0Mgmt Client SecretAUTH0_MGMT_CLIENT_SECRET64 alphanumeric
SupabaseService Role KeySUPABASE_SERVICE_ROLE_KEYJWT eyJ...
FirebasePrivate KeyFIREBASE_PRIVATE_KEYPEM RSA private key
CognitoClient SecretCOGNITO_CLIENT_SECRET64 alphanumeric
SMTPPasswordSMTP_PASSApp-specific password
ResendAPI KeyRESEND_API_KEYre_ + ~36 alphanumeric+underscore
PostmarkServer TokenPOSTMARK_SERVER_TOKENUUID lowercase 8-4-4-4-12 (36 chars)
MailgunAPI KeyMAILGUN_API_KEYkey- + 32 hex (36 chars)
MandrillAPI KeyMANDRILL_API_KEY22 chars [A-Za-z0-9_-], no prefix
MailchimpAPI KeyMAILCHIMP_API_KEY32 hex + -us + 1-2 digits (e.g. -us21)
AWS SESAccess Key + SecretAWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEYAKIA + 16 [A-Z2-7] / 40 [A-Za-z0-9/+=]
GeminiAPI KeyGEMINI_API_KEYAIza + 35 word chars (39 chars)
GroqAPI KeyGROQ_API_KEYgsk_ + 52 alphanumeric (56 chars)
MistralAPI KeyMISTRAL_API_KEY
CohereAPI KeyCOHERE_API_KEY40 alphanumeric, no prefix
ReplicateAPI TokenREPLICATE_API_TOKENr8_ + 37 alphanumeric (40 chars)
BedrockAccess Key + SecretAWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEYAKIA + 16 [A-Z2-7] / 40 [A-Za-z0-9/+=]
OpenRouterAPI KeyOPENROUTER_API_KEYsk-or-v1- + alphanumeric
ElevenLabsAPI KeyELEVENLABS_API_KEYsk_ + 48 hex (v2) or 32 hex (v1, no prefix)
Stability AIAPI KeySTABILITY_API_KEY
DeepgramAPI KeyDEEPGRAM_API_KEY40 lowercase hex, no prefix
AssemblyAIAPI KeyASSEMBLYAI_API_KEY
Google CloudAPI KeyGOOGLE_API_KEYAIza + 35 word chars (39 chars)
Google CloudService AccountGOOGLE_APPLICATION_CREDENTIALSPath to JSON file with private_key PEM

references

CREDENTIAL-SAFETY.md

FIXES.md

MANAGED-SERVICE-FLOW.md

TRUST-PROXY.md

SKILL.md

tile.json