Will It Vibe?Google OAuth client secret
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
A Google OAuth client secret (GOCSPX-...) was found. It lets an attacker complete OAuth flows as your application.
Why it matters
A Google OAuth client secret lets an attacker complete OAuth flows as your application, which can be used to phish users or obtain tokens on their behalf. It is meant to stay on your server, never in client code or the repo. Google will not rotate it for you.
How to fix it
Move the client secret into a server-side environment variable and read it at runtime. Never ship it in front-end bundles. Reset the client secret in the Google Cloud console credentials page after removing it.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo