Will It Vibe?Hardcoded session/cookie secret
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
express-session, cookie-session, or cookie-parser is initialized with a literal string secret instead of an environment variable, so anyone with the source can forge signed sessions and cookies.
Why it matters
A literal string passed as the session or cookie secret is the key that signs and verifies your session and signed cookies. Committed in source, it lets anyone who reads the repo forge a valid session for any user, bypassing authentication entirely. Shared or default secrets are also reused across environments, so a leak in one compromises all of them.
How to fix it
Load the secret from an environment variable and fail fast if it is missing, exactly as you would for any credential. Use a long random value, keep it in your host secret store, and rotate it if it was ever committed (rotating invalidates existing sessions, which is the safe outcome). Consider passing an array of secrets to support rotation.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo