# VibeCode ShipCheck report

**Verdict:** BLOCK  
**Readiness score:** 0/100 (heuristic, not a guarantee)  
**Generated:** 2026-07-18T00:00:00.000Z  
**Scope:** vulnerable-app — static pre-launch readiness review; no penetration testing

## Executive summary

ShipCheck found 15 item(s): 4 critical, 4 high, 3 medium, and 4 low.
Release should stop until every finding marked as a launch blocker is resolved and verified.

## Scan coverage

- Text files scanned: 6
- Frameworks detected: Next.js
- Package manager: not detected
- Dependency audit: skipped
- Binary/large/symlink files skipped: 0/0/0

## Findings

### F-001 · CRITICAL · Sensitive-looking variable is explicitly marked public

- Rule: SHIP-ENV-002
- Location: app/page.tsx:3
- Launch blocker: yes
- Evidence (redacted): `NEXT_PUBLIC_ADMIN_TOKEN=<redacted>`
- Impact: Public-prefixed environment variables are normally embedded into browser-delivered JavaScript.
- Remediation: Move the operation requiring this value to server-only code, rename the variable without a public prefix, then rotate any previously deployed value.
- Verification note: Some provider identifiers are intentionally publishable. Confirm the provider's documentation and least-privilege scope.

### F-002 · CRITICAL · Credential-like value is present in repository content

- Rule: SHIP-SECRET-001
- Location: env.production:2
- Launch blocker: yes
- Evidence (redacted): `OpenAI-style key=<redacted:openai-key>`
- Impact: A committed or shared credential can be reused outside the intended system.
- Remediation: Revoke and rotate the credential, remove it from repository history, and load the replacement only from a server-side secret store.
- Verification note: Pattern matching cannot prove validity. Confirm whether the value is synthetic, but keep it redacted while checking.

### F-003 · CRITICAL · Sensitive-looking variable is explicitly marked public

- Rule: SHIP-ENV-002
- Location: env.production:3
- Launch blocker: yes
- Evidence (redacted): `NEXT_PUBLIC_ADMIN_TOKEN=<redacted>`
- Impact: Public-prefixed environment variables are normally embedded into browser-delivered JavaScript.
- Remediation: Move the operation requiring this value to server-only code, rename the variable without a public prefix, then rotate any previously deployed value.
- Verification note: Some provider identifiers are intentionally publishable. Confirm the provider's documentation and least-privilege scope.

### F-004 · CRITICAL · Credential-like value is stored in a public asset

- Rule: SHIP-SECRET-002
- Location: public/runtime-config.js:3
- Launch blocker: yes
- Evidence (redacted): `OpenAI-style key=<redacted:openai-key>`
- Impact: A deployed public asset can expose the credential to every visitor.
- Remediation: Revoke and rotate the credential, remove it from repository history, and load the replacement only from a server-side secret store.
- Verification note: Pattern matching cannot prove validity. Confirm whether the value is synthetic, but keep it redacted while checking.

### F-005 · HIGH · Non-template environment file is inside the scanned tree

- Rule: SHIP-ENV-001
- Location: env.production:1
- Launch blocker: no
- Evidence (redacted): `env.production (contents withheld)`
- Impact: Environment files are frequently committed, copied, or uploaded with deploy artifacts by mistake.
- Remediation: Keep only a value-free .env.example in the repository, ignore runtime env files, and configure secrets in the deployment platform.
- Verification note: Presence does not prove the file is tracked. Verify with the source-control index and deployment include rules.

### F-006 · HIGH · Server Actions accept every origin

- Rule: SHIP-NEXT-003
- Location: next.config.mjs:3
- Launch blocker: yes
- Evidence (redacted): `allowedOrigins: ["*"],`
- Impact: An unrestricted origin policy weakens a key cross-site request protection boundary.
- Remediation: Remove the override or list only the exact trusted origins required by the deployment.

### F-007 · HIGH · Build script starts a development server

- Rule: SHIP-BUILD-002
- Location: package.json:1
- Launch blocker: yes
- Evidence (redacted): `scripts.build=next dev`
- Impact: Development mode is not a reproducible or hardened production build and can stall release automation.
- Remediation: Replace the script with the framework's production build command, such as next build or vite build.

### F-008 · HIGH · Dynamic code execution primitive is present

- Rule: SHIP-CODE-001
- Location: src/render.mjs:3
- Launch blocker: no
- Evidence (redacted): `return eval(templateSource);`
- Impact: If attacker-influenced data reaches this call, it can become arbitrary JavaScript execution.
- Remediation: Replace string-to-code execution with explicit parsing, validated data structures, and allowlisted handlers.
- Verification note: This is a static signal. Confirm whether untrusted data can reach the code and whether an equivalent external control exists.

### F-009 · MEDIUM · Environment files are not visibly ignored

- Rule: SHIP-ENV-003
- Location: repository-wide
- Launch blocker: no
- Evidence (redacted): `.gitignore not found`
- Impact: A developer can accidentally add local credentials to source control.
- Remediation: Ignore .env and .env.* while explicitly allowing only value-free templates such as .env.example.

### F-010 · MEDIUM · Raw HTML rendering sink requires review

- Rule: SHIP-CODE-002
- Location: app/page.tsx:7
- Launch blocker: no
- Evidence (redacted): `return <main data-token=<redacted>} dangerouslySetInnerHTML={{ __html: html }} />;`
- Impact: Unsanitized or attacker-influenced HTML can execute script in a visitor's browser.
- Remediation: Render structured components or plain text. If rich HTML is required, use a maintained allowlist sanitizer and a restrictive CSP.
- Verification note: This is a static signal. Confirm whether untrusted data can reach the code and whether an equivalent external control exists.

### F-011 · MEDIUM · No meaningful automated test command is defined

- Rule: SHIP-TEST-001
- Location: package.json:1
- Launch blocker: no
- Evidence (redacted): `scripts.test is missing`
- Impact: Core behavior can regress without a repeatable pre-release signal.
- Remediation: Add a deterministic test command that exits non-zero on failure and run it before deployment.

### F-012 · LOW · No supported dependency lockfile was found

- Rule: SHIP-DEP-002
- Location: repository-wide
- Launch blocker: no
- Evidence (redacted): `Expected package-lock.json, pnpm-lock.yaml, or yarn.lock`
- Impact: Different installs can resolve different dependency versions.
- Remediation: Generate and commit exactly one lockfile with the package manager used by CI and production.

### F-013 · LOW · Content Security Policy is not visible in repository configuration

- Rule: SHIP-HEADERS-001
- Location: repository-wide
- Launch blocker: no
- Evidence (redacted): `No Content-Security-Policy declaration found in scanned text files`
- Impact: A browser-side injection flaw would have fewer defense-in-depth constraints.
- Remediation: Verify the live response headers. If the edge does not provide CSP, add and test a restrictive policy appropriate to the app.
- Verification note: The CDN, reverse proxy, or hosting platform may inject this header outside the repository.

### F-014 · LOW · 1 unresolved release marker in one file

- Rule: SHIP-DEBT-001
- Location: app/page.tsx:6
- Launch blocker: no
- Evidence (redacted): `// TODO: replace raw HTML before a real release.`
- Impact: An unfinished note can represent intentionally deferred behavior or a forgotten release blocker.
- Remediation: Classify each marker as release-blocking, scheduled follow-up, or obsolete; remove or link it to a tracked issue.
- Verification note: Documentation may mention marker words without representing unfinished work.

### F-015 · LOW · 1 unresolved release marker in one file

- Rule: SHIP-DEBT-001
- Location: src/render.mjs:2
- Launch blocker: no
- Evidence (redacted): `// FIXME: dynamic evaluation is intentionally unsafe in this test fixture.`
- Impact: An unfinished note can represent intentionally deferred behavior or a forgotten release blocker.
- Remediation: Classify each marker as release-blocking, scheduled follow-up, or obsolete; remove or link it to a tracked issue.
- Verification note: Documentation may mention marker words without representing unfinished work.

## Limitations

- Static heuristics can produce false positives and cannot prove exploitability or runtime reachability.
- Files larger than the configured limit, binary files, symlinks, generated output, dependencies, and ignored directories are not inspected.
- Runtime headers, deployment-platform settings, secret-manager configuration, and external services require separate verification.
- A pass verdict is not a security guarantee; it means this bounded scan found no medium-or-higher release condition.