SSRF + cloud metadata endpoint access
Server-Side Request Forgery lets attackers make your server fetch internal URLs. On cloud platforms (AWS, GCP, Railway, Vercel) the instance metadata endpoint at 169.254.169.254 returns credentials that can compromise your entire cloud account.
HOW VIBECHECK DETECTS THIS
vibecheck clones your repository and runs Gitleaks, Semgrep, njsscan, and a suite of custom checks targeting patterns common in AI-generated code. This check is part of the Server-Side category. When a matching pattern is found, Claude triages the finding and produces a plain-English explanation and a concrete fix — no security expertise required.
FREE SCAN
Check your repo for this and 50+ other issues
Connect GitHub → vibecheck scans for secrets, unauthenticated routes, RLS gaps, injection, and more. Claude explains every finding. Free for 2 repos.
scan my repo for free →