Will It Vibe?next/image remote host wildcard
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
A wildcard image hostname (remotePatterns hostname "**"/"*" or domains ["*"]) turns the built-in image optimizer into an open proxy that will fetch and cache any URL, which can be abused for bandwidth and SSRF-style probing.
Why it matters
A wildcard image hostname (remotePatterns hostname "**" or "*", or domains ["*"]) tells the next/image optimizer to fetch and cache images from any URL a client asks for. That turns the endpoint into an open proxy, which attackers use to burn your bandwidth and to probe internal or third-party hosts from your server.
How to fix it
Replace the wildcard with an explicit allowlist of the exact hostnames you serve images from, using remotePatterns with a concrete hostname and, where possible, a pathname prefix. Add each real host you need rather than opening it to everything.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo