Will It Vibe?Mongo query object built directly from request input
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
Passing req.body/query/params straight into a Mongo filter lets a client inject operators such as {$gt:""} or {$ne:null} to bypass the intended match. Heuristic: casting/validating the value first is safe.
Why it matters
Passing req.body/query/params straight into a Mongo filter lets a client send an object like {"$gt":""} or {"$ne":null} in place of a scalar, changing the query to match records it should not. This bypasses login checks and access filters. It is a heuristic: casting or validating the value first makes it safe.
How to fix it
Coerce each value to the expected primitive type before querying (String(req.body.username)) and validate the shape with a schema library such as zod or joi. Reject objects where you expect a string. Enable a query sanitizer such as express-mongo-sanitize as defense in depth.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo