Will It Vibe?Hardcoded numeric ID in a route path
Part of Architecture & Best Practices, which counts for 15% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
A route path contains a bare numeric segment (for example /users/42/profile) instead of a parameter like /users/:id. As written, the route only ever matches that one resource, which is almost always leftover debug or example code rather than an intentional design; a real caller needing a different ID gets a 404. This is a heuristic: a route that legitimately targets one fixed numeric endpoint (a specific status-code demo page, for instance) is rare but possible.
Why it matters
A route path with a hardcoded number, like /users/42/profile, only ever matches that one specific resource. Every other user ID gets a 404, which strongly suggests this was written to test or demonstrate one specific case and never generalized into a real parameterized route. If it shipped this way, real callers needing any ID besides 42 cannot use the endpoint at all.
How to fix it
Replace the hardcoded number with a named route parameter, for example /users/:id/profile, and update the handler to read the value from req.params.id instead of the literal. Check whether the caller that hits this route was also hardcoded to the same number and fix it at the same time.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo