Is Your Vibe-Coded App Leaking Data?
5 Quick Checks You Can Do Right Now

Your .env file contains every secret your app needs to run: database credentials, API keys, OAuth secrets, encryption keys. It was never meant to be served over the web — but in a surprising number of deployed apps, it is.

curl -s https://yoursite.com/.env | head -20
# Or just open this URL in your browser:
# https://yoursite.com/.env

If your .git directory is accessible over the web, attackers can reconstruct your entire codebase — including files you deleted from your repository. Including .env files you committed and then removed. Including API keys you "rotated" six months ago but forgot to actually revoke.

# Check 1: Is the .git folder exposed?
curl -s https://yoursite.com/.git/HEAD

# If you see something like "ref: refs/heads/main"
# your entire git history is downloadable.

# Check 2: Can the config file be read?
curl -s https://yoursite.com/.git/config

This one is subtle and extremely common in AI-generated code. When you ask an AI to "add Stripe to my app" or "integrate the OpenAI API," it will sometimes generate code that puts the secret key directly in your frontend JavaScript. The logic is sound from a "getting it to work" perspective. The security implications are catastrophic.

# View your page source and search for key patterns
curl -s https://yoursite.com | grep -iE "(sk_live|sk_test|api_key|secret|token)" | head -20

# Also check your main JS bundle
# Open DevTools → Sources → look for sk_live_, Bearer tokens,
# or anything that looks like a secret in your .js files

AI tools love generating admin panels. They're one of the first things you ask for: "add an admin dashboard where I can see all users." The panel gets built, it works, and it gets deployed. But does it actually require authentication? Is it at a predictable URL? Is the authentication bypassable?

# Try common admin paths directly in your browser:
https://yoursite.com/admin
https://yoursite.com/admin/dashboard
https://yoursite.com/admin/users
https://yoursite.com/dashboard
https://yoursite.com/api/admin/users

# For each one: do you get a login prompt, or do you get data?

This one is invisible until it's a problem. AI-generated code is enthusiastic about logging — it adds console.log() and debug statements liberally, because they're helpful for development. The problem is that those logs often end up in production, and they often contain things that should never appear in a log: passwords, tokens, user emails, request bodies with payment information.

# Search your codebase for problematic logging patterns
grep -r "console.log" . --include="*.js" | grep -iE "(password|token|secret|email|credit|card|ssn|auth)" | head -20

# Also check: does your error handler log the full request body?
# Does your ORM log queries with interpolated values?
# Does your auth middleware log the Authorization header?

// This logs everything, including passwords
app.post('/api/login', (req, res) => {
  console.log('Login attempt:', req.body); // ← Logs username + password
  const { email, password } = req.body;
  // ...
});

// This leaks tokens
app.use((err, req, res, next) => {
  console.error('Error:', req.headers); // ← Logs Authorization header
  res.status(500).json({ error: err.message });
});

// Log only what you need — never sensitive fields
app.post('/api/login', (req, res) => {
  console.log('Login attempt for:', req.body.email); // ← Safe
  const { email, password } = req.body;
  // ...
});

// Sanitize error logs
app.use((err, req, res, next) => {
  console.error('Error on', req.method, req.path, err.message); // ← Safe
  res.status(500).json({ error: 'Internal server error' });
});