Will It Vibe?Express app without input validation
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
An Express/Fastify server has no schema-validation library, so route handlers likely trust request bodies and query strings unchecked. Heuristic based on dependencies.
Why it matters
With no validation library, handlers tend to read req.body and req.query fields directly and trust their type and shape. That is how type-confusion, NoSQL operator injection, and mass-assignment bugs get in, and it makes every handler responsible for its own ad-hoc checks. A schema at the edge rejects malformed input once, before it reaches your logic. This is a dependency-based heuristic.
How to fix it
Adopt one schema validator (zod, joi, or express-validator) and validate body, query, and params at the start of each route, rejecting anything that does not match. Parse into typed values rather than reading raw fields, and return 400 with a safe message on failure. Keep the schemas next to the routes they guard.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo