Will It Vibe?Admin-looking route with no auth middleware in the file
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
A route whose URI starts with /admin or /dashboard is defined in a routes file that contains no middleware(), Gate::, ->can(), or ->authorize() call anywhere. Heuristic: this cannot see route-group middleware defined in a different file or authorization performed inside the controller, so it only fires when the whole file shows no trace of authorization at all.
Why it matters
A route under /admin or /dashboard with no auth middleware, Gate check, or authorize() call anywhere in its routes file is either publicly reachable or relies on protection defined somewhere this check cannot see, a route-group in another file, or a check inside the controller. When it really is unprotected, anyone who finds the URL has whatever access that route grants, no login required.
How to fix it
Wrap the route, or the group it belongs to, in ->middleware('auth') at minimum, and add role or permission checks via Gate or a Policy if admin access needs to be restricted beyond "any logged-in user." If protection genuinely lives elsewhere, a route-group in another file, or inside the controller, leave the route as-is and note where the protection actually lives so it is easy to verify.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo