15 security mistakes AI-generated
code makes, and how to fix them
This is the complete list of what the free scanner checks for in JavaScript and TypeScript. Every rule fires the same way every time, and every one comes with a plain-English explanation and a fix you can paste into your AI tool.
npx @sixthwall/cli initLogins and sessions
- criticalClient-Side Only Auth CheckAI-AUTH-002
Authentication is checked only on the client side using browser storage.
- criticalPassword Stored in Plain TextAI-AUTH-005
Passwords are stored or compared in plain text without cryptographic hashing.
- highMissing Authentication MiddlewareAI-AUTH-001
Express/Hono routes are defined without authentication middleware.
- highJWT Without ExpirationAI-AUTH-003
JWT tokens are created without an expiration time.
- mediumInsecure Cookie ConfigurationAI-AUTH-004
Authentication cookies are set without security flags.
User input reaching your database
Secrets and API keys
- criticalHardcoded API Key in Client CodeAI-SECRET-001
An API key or secret is hardcoded directly in your source code.
- highEnvironment Variable in Client BundleAI-SECRET-002
Sensitive environment variables are referenced in client-bundled code.
- high.env File Not in .gitignoreAI-SECRET-003
Your project uses dotenv to load .env files but may not have them in .gitignore.
Configuration
- highOverly Permissive CORSAI-CONFIG-001
CORS is configured to allow requests from any origin.
- mediumDebug Mode Enabled in ProductionAI-CONFIG-002
Debug mode or verbose error logging is enabled in your code.
- mediumMissing Rate LimitingAI-CONFIG-003
Your application has auth routes but no rate limiting.
- mediumVerbose Error Messages in ProductionAI-CONFIG-004
Error handlers return detailed error information (stack traces, internal messages) to the client.