Will It Vibe?Client-side open redirect from query parameters
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
A navigation target (location.href / location.assign / location.replace) is built from location.search, URL params, or document.referrer.
Why it matters
Building a navigation target from location.search, URL params, or document.referrer lets an attacker put any address in the link and send your users there. It is used for phishing (the link looks like your domain but bounces to a lookalike) and, with javascript: URLs, for script execution. The redirect happens in the browser so server-side checks do not catch it.
How to fix it
Do not assign untrusted input directly to location. Validate the value against an allowlist of known paths, or only allow same-origin relative paths (reject anything starting with a scheme, //, or backslashes). For internal navigation prefer a router push with a known route rather than a raw URL. Fall back to a safe default when validation fails.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo