checkmyvibe 1.1.0 → 1.2.0

package/README.md

@@ -1,6 +1,6 @@
 # checkmyvibe
 
-A structured, zero-dependency, local production readiness and code quality workflow packaged as an Agent Skill for AI coding assistants (such as Claude Code, Cursor, Codex, and Gemini CLI).
+A structured, zero-dependency, local production readiness and code quality workflow packaged as an Agent Skill for AI coding assistants. Built for Claude Code today; the skill and command files can be adapted to other agents' rule/command formats.
 
 AI-generated ("vibe-coded") applications built on modern AI tools frequently ship with serious, well-documented configuration and quality issues—such as exposed API keys, fake authentication stubs, permissive default database rules, and client-side pricing logic. **checkmyvibe** solves this by packaging readiness and verification checks directly into an Agent Skill. When you ask your coding agent to "run checkmyvibe" or "perform a readiness check", the agent uses checkmyvibe's local helper scripts and its own reasoning capabilities to analyze your codebase, producing a prioritized report detailing what configuration issues or gaps exist, why they matter, and how to fix them.
 
@@ -13,7 +13,7 @@ AI-generated ("vibe-coded") applications built on modern AI tools frequently shi
 *   **Fake & Stubbed Authentication:** Greps for common mock authentication markers (such as functions named `mockAuth`, `fakeLogin`, `tempAuth`, or logic that returns `true` unconditionally to bypass authentication checks).
 *   **Database Misconfigurations:** Identifies permissive default rules (such as `allow read, write: if true;` in Firebase/Firestore configs) and checks if Row-Level Security (RLS) is enabled on Supabase database schemas.
 *   **Broken Object-Level Authorization (BOLA/IDOR):** Analyzes API routes to check if endpoints fetch resources by ID without validating that the authenticated user owns or has permission to access that resource.
-*   **Client-Side Payment & Pricing Logic:** Scans checkout routes and payment integrations to check if prices or transaction values are calculated or accepted directly from client-side parameters rather than securely fetched on the server.
+*   **Client-Side Payment & Pricing Logic:** Scans checkout routes and payment integrations to check if prices or transaction values are calculated or accepted directly from client-side parameters rather than securely fetched on the server, and verifies that payment webhooks validate provider signatures before trusting event payloads.
 
 ---
 
@@ -59,12 +59,14 @@ When actively developing a specific feature, run focused scans for fast, targete
 
 | Slash Command | Scope / Keyword | Included Checks | Use Case |
 | :--- | :--- | :--- | :--- |
-| `/checkmyvibe-secrets` | `/checkmyvibe secrets` | Check 1 + Check 2 | Exposed API keys, hardcoded credentials, and `.gitignore` hygiene |
+| `/checkmyvibe-secrets` | `/checkmyvibe secrets` | Checks 1a + 1b + 2 | Server-side and client-exposed API keys/credentials, plus `.gitignore` hygiene |
 | `/checkmyvibe-auth` | `/checkmyvibe auth` | Check 3 | Missing, mock, stubbed, or bypassed authentication guards |
 | `/checkmyvibe-db` | `/checkmyvibe db` | Check 4 | Database & BaaS rules, Supabase RLS policies, Firebase permissions |
-| `/checkmyvibe-backend` | `/checkmyvibe backend` | Checks 3, 4, 5, 6 (server), 7 | All server-side logic: auth, DB/RLS, IDOR/BOLA, SQLi/input validation, pricing |
-| `/checkmyvibe-frontend` | `/checkmyvibe frontend` | Checks 1 (client), 3 (client), 7 (client) | Client bundle key leaks, UI-only auth hiding, client-side pricing overrides |
-| `/checkmyvibe-payment` | `/checkmyvibe payment` | Check 7 | Client-side payment tampering, price overrides, and checkout integrity |
+| `/checkmyvibe-backend` | `/checkmyvibe backend` | Checks 1a, 3, 4, 5, 6 (server), 7 (server) | All server-side logic: hardcoded server credentials, auth, DB/RLS, IDOR/BOLA, SQLi/input validation/mass assignment, payment & webhook processing |
+| `/checkmyvibe-frontend` | `/checkmyvibe frontend` | Checks 1b, 3 (client), 7 (client) | Client bundle key leaks, UI-only auth hiding, client-side pricing overrides |
+| `/checkmyvibe-payment` | `/checkmyvibe payment` | Check 7 | Client-side payment tampering, price overrides, unverified webhooks, checkout integrity |
+
+Each scoped command file contains its complete operating instructions inline — it only falls back to `SKILL.md` for the report format and severity rubric — so scoped scans work reliably even when skill auto-discovery fails.
 
 The agent will walk through the scoped checks, execute relevant local helper scripts, and print a prioritized markdown report (Critical / Should Fix / Worth Reviewing) with concrete remediation steps.
 

package/SKILL.md

@@ -40,13 +40,15 @@ checkmyvibe supports targeted/scoped scanning for rapid iteration during develop
 
 | Scope / Command Keyword | Included Checks | Description / Focus Area |
 | :--- | :--- | :--- |
-| **`secrets`** | **Check 1 + Check 2** | Exposed credentials, API keys, tokens, and `.gitignore` file protection |
+| **`secrets`** | **Check 1a + Check 1b + Check 2** | Server-side and client-exposed credentials, API keys, tokens, and `.gitignore` file protection |
 | **`auth`** | **Check 3** | Missing, mock, stubbed, or bypassed authentication guards |
 | **`db`** | **Check 4** | Database & BaaS rules, Supabase RLS policies, Firebase/storage permissions |
-| **`backend`** | **Check 3 + Check 4 + Check 5 + Check 6 (server-side) + Check 7** | All server-side logic: auth guards, database configs, IDOR/BOLA, SQLi/input validation, and payment processing |
-| **`frontend`** | **Check 1 (client-exposed) + Check 3 (client-only auth) + Check 7 (client pricing)** | Client-side bundle leaks, UI-only auth hiding, and client-controlled payment/pricing logic |
-| **`payment`** | **Check 7** | Client-side payment amount tampering, price overrides, and checkout integrity |
-| *(no argument / `full`)* | **All Checks (1–7)** | Full production readiness and code quality audit |
+| **`backend`** | **Check 1a + Check 3 + Check 4 + Check 5 + Check 6 (server-side) + Check 7 (server-side)** | All server-side logic: hardcoded server credentials, auth guards, database configs, IDOR/BOLA, SQLi/input validation, mass assignment, and payment/webhook processing |
+| **`frontend`** | **Check 1b + Check 3 (client-side view) + Check 7 (client-side view)** | Client-side bundle leaks, UI-only auth hiding, and client-controlled payment/pricing logic |
+| **`payment`** | **Check 7** | Client-side payment amount tampering, price overrides, unverified webhooks, and checkout integrity |
+| *(no argument / `full`)* | **All Checks (1a–7)** | Full production readiness and code quality audit |
+
+> **Canonical definitions note:** The check definitions in this file are canonical. The scoped command files (`commands/checkmyvibe-*.md`) contain mirrored copies of their relevant checks so they can run standalone. When you change what a check does, update it here AND in every command file that mirrors it.
 
 ### Rules for Scoped Runs:
 - **Execute only the selected checks:** Do not run unselected check scripts or inspect code outside the chosen scope.
@@ -88,7 +90,7 @@ Critical user exposure > auth bypass > IDOR > payment logic > config issues > hy
 
 The report should help the coding agent make the repo safer in the next commit, not just describe problems.
 
-## Check 1: Exposed secrets and credentials
+## Check 1a: Server-side secrets and credentials
 
 **Run the script** `scripts/scan_secrets.py` (located relative to this `SKILL.md` file) against the project root. It flags known key
 prefixes (`sk_live`, `sk_test`, `AIza`, `AKIA`, `ghp_`, `xox[bp]`), high-entropy
@@ -97,14 +99,13 @@ strings, and variable assignments where a name like `key`, `secret`, `token`, or
 
 **What counts as a finding:**
 
-- A real credential committed directly in source, e.g.:
-  `const stripeKey = "sk_live_51H8x..."` — Critical
-- A secret present only in `.env` but `.env` is not gitignored (see Check 2) —
-  Critical, because it WILL leak on the next commit even if it hasn't yet
-- A secret exposed to the client bundle — e.g. a server-only key referenced in
-  frontend code, or a Next.js env var missing the required server-only scoping
-  (using a secret key where only `NEXT_PUBLIC_`-prefixed vars should appear) —
-  Critical, this is directly shippable to every visitor's browser
+- A real credential committed directly in server-side source, e.g.:
+  `const stripeKey = "sk_live_51H8x..."` — **Critical**
+- A **live** Stripe secret key (`sk_live_...`) anywhere in source — **Critical**, charges real cards
+- A **test** Stripe secret key (`sk_test_...`) committed in source — **Should Fix**, not production-critical but test keys still must not be committed; rotate if the repo has ever been shared
+- A server-only credential referenced in frontend code, or a Next.js env var
+  missing the required server-only scoping (using a secret key where only
+  `NEXT_PUBLIC_`-prefixed vars should appear) — **Critical**, this is directly shippable to every visitor's browser
 
 **What is NOT a finding (avoid false positives):**
 
@@ -114,6 +115,20 @@ strings, and variable assignments where a name like `key`, `secret`, `token`, or
   configured. Note this distinction explicitly in the report so the user isn't
   confused about why one key is fine and another isn't.
 - Example/placeholder values clearly meant as documentation, e.g. `"your-api-key-here"`
+- Fake credentials inside unit tests, fixtures, or mock files (the scripts already skip these directories; if you find one manually, do not report it)
+
+## Check 1b: Client-exposed secrets (frontend scope view)
+
+This is the client-facing slice of Check 1a, used by the `frontend` scope. Focus on:
+
+- Secrets reachable from the client bundle: any secret referenced in frontend
+  code, anything passed through `NEXT_PUBLIC_*` / `VITE_*` / `REACT_APP_*` env
+  vars that isn't genuinely public, and secrets inlined in client config files.
+- Service-role keys (Supabase `service_role`, Firebase admin SDK private keys,
+  OpenAI/Stripe secret keys) appearing anywhere under `src/`, `app/`,
+  `components/`, `public/`, or client entry points — **Critical**.
+
+The severity rules and false-positive guidance from Check 1a apply unchanged.
 
 ## Check 2: .gitignore hygiene
 
@@ -231,6 +246,14 @@ Spot-check forms and API endpoints for:
 - User input rendered into HTML without escaping (XSS risk), especially in
   frameworks that don't auto-escape by default
 - File uploads with no restriction on file type or size
+- **Mass assignment:** request bodies spread directly into ORM create/update calls,
+  e.g. `await prisma.user.update({ where: { id }, data: req.body })` — lets a user
+  set fields they should never control (`role`, `plan`, `isAdmin`, `emailVerified`).
+  Flag when the body is not explicitly whitelisted to safe fields. — Critical if a
+  privileged field can be set, otherwise Should Fix
+- **No rate limiting on auth endpoints:** login, signup, password reset, and OTP
+  endpoints with no throttle/attempt limit allow credential stuffing and SMS-cost
+  abuse — Worth Reviewing at minimum, Should Fix for payment-handling apps
 
 This check doesn't need to be exhaustive — flag the clearest, highest-impact
 examples rather than every single form field, and note in the summary that a
@@ -257,6 +280,30 @@ app.post('/api/checkout', async (req, res) => {
 });
 ```
 
+Also check **payment webhook signature verification** — this is the sibling flaw to
+client-side pricing and just as common:
+
+- A webhook endpoint (Stripe, Firebase, PayPal, Razorpay) that reads the event body
+  and acts on it **without verifying the signature first**. Anyone who finds the URL
+  can POST `{ "type": "payment_intent.succeeded", ... }` and get their order marked paid.
+- Correct pattern (Express + Stripe):
+  ```js
+  app.post('/api/webhooks/stripe',
+    express.raw({ type: 'application/json' }), // raw body required for signature check
+    (req, res) => {
+      const event = stripe.webhooks.constructEvent(
+        req.body, req.headers['stripe-signature'], process.env.STRIPE_WEBHOOK_SECRET
+      );
+      // only now is the event trustworthy
+    });
+  ```
+- Equivalent checks: Firebase Cloud Functions `onRequest` deployed with secret
+  headers compared server-side, PayPal webhook `verify-webhook-signature` API,
+  Razorpay `verifyPaymentSignature`. If a webhook route exists and no signature
+  verification call exists anywhere in the flow — **Critical**.
+- Discount/coupon values accepted from the client rather than looked up from a
+  trusted source server-side — same severity as price tampering.
+
 ---
 
 ## Severity rubric
@@ -303,6 +350,8 @@ Once the checks are complete, create a readiness review report. **The report mus
 - what still needs attention
 - the final readiness verdict
 
+**Post-fix verification:** if you applied fixes during this session, re-run the scripts for every category you touched and confirm the finding is actually gone before marking it fixed in the report. Report before/after per check (e.g. "scan_secrets.py: 3 findings → 0 findings"). A fix that hasn't been re-scanned must be listed as "applied, not yet verified", never as resolved.
+
 If no issues are found, still produce a short report that says no blocking issues were found in this pass, which categories were checked, and what the remaining scope limits are.
 
 ## Example report style

package/commands/checkmyvibe-auth.md

@@ -1,3 +1,46 @@
-Read the checkmyvibe `SKILL.md`. Run only **Check 3 (missing or fake authentication)** from that skill.
+# /checkmyvibe-auth — Missing or fake authentication
 
-Use the same report format, severity rubric, and final summary structure defined in `SKILL.md`, but scope the final summary to note that this was an authentication-only check (Checks 1, 2, 4, 5, 6, and 7 were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is an **authentication-only check** (Check 3). Checks 1a/1b, 2, 4, 5, 6, and 7 are skipped and must be listed as skipped in the final summary.
+
+## Step 1 — Run the first-pass script
+
+```bash
+python <skill_dir>/scripts/check_auth_patterns.py <target>
+```
+
+It flags stub names (`mockAuth`, `fakeLogin`, `tempAuth`, `bypassAuth`, ...) and always-true auth functions. If Python is unavailable or it fails, say so and do the equivalent greps manually. The script skips test directories — do not report mock auth inside unit tests even if you see it manually.
+
+## Step 2 — Manual reasoning pass (this is where the real findings are)
+
+The script is a first pass only. Read the actual auth code: login handlers, middleware, route guards, session checks, and every route that returns or modifies user-specific data.
+
+Findings to hunt for:
+
+- **Always-true stubs:** `function isAuthenticated() { return true; }`, `const checkAdmin = () => true` — Critical.
+- **Stub-named helpers still wired in:** `mockAuth`, `devAuth`, `bypassAuth` reachable in production paths — Critical. Properly guarded behind `NODE_ENV === 'development'` → Should Fix (env misconfig leaks these constantly); verify the guard actually covers every import/call site.
+- **Protected routes with no auth check at all:** list every route returning user-specific data, then check each one calls the session/auth middleware. A `/api/orders/:id` with no guard is Critical regardless of what the UI does.
+- **Client-side-only enforcement:** UI hides a button/route for logged-out users but the underlying API never verifies the session — Critical. Anyone calls the API directly. To confirm this you MUST read the corresponding server route; do not clear a finding from the frontend alone.
+- **Commented-out auth checks** with an active bypass nearby.
+- **JWT/session verification gaps:** tokens decoded but not verified (`jwt.decode` instead of `jwt.verify`, no algorithm pinning), sessions accepted from client-controlled storage without server validation — Critical.
+
+## Step 3 — Judgment rules
+
+- Read the function body fully before flagging or clearing — never decide from the name alone.
+- Prefer one precise finding over several weak ones; tag uncertain items `High confidence` / `Medium confidence` / `Needs manual review`.
+- Identify the stack's intended auth mechanism (NextAuth, Clerk, Supabase Auth, custom JWT) first; "missing" means missing relative to how routes access user data, not absence of a specific library.
+
+## Report
+
+Use the format, severity rubric, and final-summary structure from SKILL.md. Scope reminder: "authentication-only check — secrets, .gitignore, database rules, IDOR, input validation, and payment checks were skipped. This does not mean the app is production-ready. Run a full `/checkmyvibe` audit before launch."

package/commands/checkmyvibe-backend.md

@@ -1,8 +1,62 @@
-Read the checkmyvibe `SKILL.md`. Run only the server-side / backend checks from that skill:
-- **Check 3 (missing or fake authentication)**
-- **Check 4 (database and backend-as-a-service misconfiguration)**
-- **Check 5 (broken object-level authorization / IDOR)**
-- **Check 6 (unvalidated inputs, server-side / query portion)**
-- **Check 7 (payment and pricing logic)**
-
-Use the same report format, severity rubric, and final summary structure defined in `SKILL.md`, but scope the final summary to note that this was a backend-only check (Check 1 client bundle secrets and Check 2 .gitignore hygiene were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.
+# /checkmyvibe-backend — Server-side audit
+
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is a **backend-only check**: Check 1a (server-side secrets) + Check 3 (auth) + Check 4 (db) + Check 5 (IDOR) + Check 6 server-side + Check 7 server-side. Skipped and to be listed as such in the summary: Check 1b (client-exposed secrets), Check 2 (.gitignore hygiene), and client-side views of checks 3/6/7.
+
+## Step 1 — Run all three scripts
+
+```bash
+python <skill_dir>/scripts/scan_secrets.py <target>
+python <skill_dir>/scripts/check_auth_patterns.py <target>
+python <skill_dir>/scripts/check_db_config.py <target>
+```
+
+Triage per the rules in `/checkmyvibe-secrets`, `/checkmyvibe-auth`, and `/checkmyvibe-db` respectively: live keys Critical / test keys Should Fix; mock-auth hits outside tests need manual reading; missing RLS and `USING (true)` policies are Critical on user-data tables. If Python is unavailable, do each check manually and say so in the report.
+
+## Step 2 — IDOR sweep (Check 5 — spend the most time here)
+
+This is the single most common serious flaw in AI-generated apps. Enumerate every route that takes an ID (URL param, query string, or body field) and touches a database record:
+
+```js
+// Finding example — Critical: any logged-in user reads ANY order
+app.get('/api/orders/:id', requireAuth, async (req, res) => {
+  const order = await db.query('SELECT * FROM orders WHERE id = $1', [req.params.id]);
+  res.json(order);
+});
+
+// Correct fix pattern: scope by owner, return 404 when absent
+const order = await db.query(
+  'SELECT * FROM orders WHERE id = $1 AND user_id = $2', [req.params.id, req.user.id]);
+if (!order) return res.status(404).json({ error: 'Not found' });
+```
+
+Check GET (exposure), PUT/PATCH (unauthorized modification), and DELETE (often most damaging) for all of them. An auth guard alone is not enough — ownership must be enforced in the query or immediately after fetch.
+
+## Step 3 — Server-side input handling (Check 6)
+
+- SQL built by string concatenation instead of parameterized queries/ORM → Critical.
+- **Mass assignment:** `req.body` spread straight into ORM create/update (`prisma.user.update({ data: req.body })`, `User.findByIdAndUpdate(id, req.body)`) letting users set `role`, `plan`, `isAdmin`, `emailVerified` → Critical; non-privileged fields → Should Fix.
+- Unescaped user input into HTML in non-auto-escaping frameworks → flag worst cases.
+- Login/signup/password-reset/OTP endpoints with no rate limiting → Should Fix for payment-handling apps, Worth Reviewing otherwise.
+- File uploads with no type/size restriction.
+
+## Step 4 — Payment processing & webhooks (Check 7, server side)
+
+- Price/discount/total taken from request body, query param, or hidden field instead of looked up from the DB → Critical.
+- **Webhook signature verification:** every payment webhook route (Stripe, PayPal, Razorpay, Firebase) must verify the signature before trusting the body — e.g. Stripe's `stripe.webhooks.constructEvent(rawBody, sigHeader, webhookSecret)` with the raw body. A webhook route with no signature verification anywhere in its flow → Critical: anyone can POST "payment succeeded" and get their order marked paid.
+- Webhook handlers acting on unverified amounts read from the event body → same severity.
+
+## Report
+
+Use the format, severity rubric, evidence/confidence rules, and post-fix verification step from SKILL.md. Fix priority when multiple issues exist: critical user exposure > auth bypass > IDOR > payment logic > config > hygiene. Scope reminder: "backend-only check — client-exposed secrets, .gitignore hygiene, and frontend-side views were skipped. This does not mean the app is production-ready. Run a full `/checkmyvibe` audit before launch."

package/commands/checkmyvibe-db.md

@@ -1,3 +1,51 @@
-Read the checkmyvibe `SKILL.md`. Run only **Check 4 (database and backend-as-a-service misconfiguration)** from that skill.
+# /checkmyvibe-db — Database & BaaS misconfiguration
 
-Use the same report format, severity rubric, and final summary structure defined there, but scope the final summary to note that this was a database-only check (Checks 1, 2, 3, 5, 6, and 7 were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is a **database-only check** (Check 4). Checks 1a/1b, 2, 3, 5, 6, and 7 are skipped and must be listed as skipped in the final summary.
+
+## Step 1 — Run the first-pass script
+
+```bash
+python <skill_dir>/scripts/check_db_config.py <target>
+```
+
+It scans SQL files for tables created without RLS and permissive policies (`USING (true)` / `WITH CHECK (true)`), Firestore/storage rules for `allow ...: if true`, and Realtime Database rules set to `"true"`. If Python is unavailable or it fails, do the equivalent checks by reading schema/rules files manually and say so in the report.
+
+## Step 2 — Supabase (if used)
+
+- Every table holding user-specific data must have `ENABLE ROW LEVEL SECURITY`. A table without it → Critical.
+- Policies granting broad access fail: `FOR SELECT USING (true)`, policies `TO public/anon` with unconditional USING/CHECK → Critical.
+- Recommended fix pattern:
+  ```sql
+  CREATE POLICY "users see own orders" ON orders
+    FOR SELECT USING (auth.uid() = user_id);
+  ```
+- Check migrations/schema files under `supabase/migrations/`, `db/`, or wherever `.sql` files live. Also confirm RLS wasn't enabled *after* data was already readable via the anon key in earlier deployments.
+
+## Step 3 — Firebase (if used)
+
+- `firestore.rules`: any `allow read, write: if true;` on collections holding user data → Critical. Test-mode rules (`allow read, write: if <timestamp>`) pasted into prod-like configs → Should Fix minimum.
+- `database.rules.json` (Realtime DB): `".read": "true"` / `".write": "true"` on user-data nodes → Critical.
+- Rules files present but clearly unused/default → Worth Reviewing; verify which project they deploy to.
+
+## Step 4 — Storage buckets
+
+Supabase Storage, Firebase Storage, S3:
+
+- Public buckets holding private user content (documents, receipts, profile files) → Critical.
+- Public buckets for genuinely public assets (avatars, static images) → not findings; note the distinction.
+
+## Report
+
+Use the format, severity rubric, and final-summary structure from SKILL.md. Scope reminder: "database-only check — secrets, .gitignore, authentication, IDOR, input validation, and payment checks were skipped. This does not mean the app is production-ready. Run a full `/checkmyvibe` audit before launch."

package/commands/checkmyvibe-frontend.md

@@ -1,6 +1,48 @@
-Read the checkmyvibe `SKILL.md`. Run only the frontend / client-side checks from that skill:
-- **Check 1 (client-exposed secrets in frontend bundles and environment configurations)**
-- **Check 3 (client-side-only auth checks / UI hiding without server enforcement)**
-- **Check 7 (client-side payment or pricing logic)**
+# /checkmyvibe-frontend — Client-side audit
 
-Use the same report format, severity rubric, and final summary structure defined in `SKILL.md`, but scope the final summary to note that this was a frontend-only check (Check 2 .gitignore hygiene, Check 4 database rules, Check 5 IDOR, Check 6 server input validation, and full server auth checks were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is a **frontend-only check**: Check 1b (client-exposed secrets) + Check 3 viewed from the client (UI-only enforcement) + Check 7 viewed from the client (client-controlled pricing). Skipped and to be listed as such in the summary: Check 1a standalone triage, Check 2 (.gitignore), Check 4 (db rules), Check 5 (IDOR sweep), and full server-side reviews of auth/input/payment.
+
+## Step 1 — Client-exposed secrets (run script, then manual pass)
+
+```bash
+python <skill_dir>/scripts/scan_secrets.py <target>
+```
+
+Then manually inspect everything reachable from the browser:
+
+- Framework env prefixes bundle values INTO shipped JS: `NEXT_PUBLIC_*`, `VITE_*`, `REACT_APP_*`, `EXPO_PUBLIC_*`. Any secret behind one of these → Critical.
+- Supabase `service_role` key, Firebase admin SDK JSON, OpenAI/Stripe secret keys anywhere under `src/`, `app/`, `components/`, `pages/`, `public/`, or client entry files → Critical.
+- Publishable keys (`pk_`, Supabase anon key, Firebase web config `apiKey`) are public-by-design → NOT findings; say so explicitly so the report isn't confusing.
+- Placeholders and test-fixture values → not findings.
+
+## Step 2 — UI-only auth enforcement (Check 3, client view)
+
+Find every place the UI gates access: redirects on protected pages, hidden nav items, disabled buttons, client route guards:
+
+- For each gated feature, open the corresponding API route/mutation and confirm it independently verifies the session server-side. If it does not → Critical ("hiding the button does nothing; anyone calls the API directly").
+- Auth state trusted purely from client storage (localStorage JWT, global store) to protect data → Critical if no server verification exists.
+- You must read the server routes to clear or confirm findings — a clean-looking frontend proves nothing on its own.
+
+## Step 3 — Client-controlled pricing (Check 7, client view)
+
+Inspect checkout/cart/pricing flows:
+
+- Prices, discounts, totals, or quantities computed client-side and sent as the chargeable value (hidden form fields, request bodies, query params) → Critical on the corresponding server endpoint.
+- Coupon codes validated only in the UI → flag the endpoint that accepts them without server-side validation.
+- Note exactly which server endpoint accepts the tainted value so the backend fix is obvious.
+
+## Report
+
+Use the format, severity rubric, and final-summary structure from SKILL.md. Scope reminder: "frontend-only check — server-side secret triage, .gitignore hygiene, database rules, IDOR, server input validation, and webhook verification were skipped. This does not mean the app is production-ready. Run a full `/checkmyvibe` audit before launch."

package/commands/checkmyvibe-payment.md

@@ -1,3 +1,52 @@
-Read the checkmyvibe `SKILL.md`. Run only **Check 7 (client-side payment or pricing logic)** from that skill.
+# /checkmyvibe-payment — Payment & pricing integrity
 
-Use the same report format, severity rubric, and final summary structure defined in `SKILL.md`, but scope the final summary to note that this was a payment/pricing-only check (Checks 1, 2, 3, 4, 5, and 6 were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is a **payment/pricing-only check** (Check 7, both client and server views). Checks 1a/1b, 2, 3, 4, 5, and 6 are skipped and must be listed as skipped in the final summary. Note: if this app handles real payments, state in the report that a professional external review is strongly recommended regardless of findings.
+
+## Step 1 — Map the payment surface
+
+Identify the provider (Stripe, PayPal, Razorpay, Firebase-based, custom) and locate: checkout endpoints, webhook routes, cart/price calculation code (client and server), subscription/plan management, and coupon/discount handling. If there is no payment code at all, report "No issues found — no payment flow exists" and stop.
+
+## Step 2 — Server-side price trust
+
+For each chargeable action:
+
+- Is the amount read from the request (body field, query param, hidden form field) or computed from client-supplied data? → Critical:
+  ```js
+  // Finding example — Critical
+  const { productId, price } = req.body;
+  await chargeCard(req.user.paymentMethod, price);
+
+  // Correct fix pattern — server looks up the price
+  const { productId } = req.body;
+  const product = await db.query('SELECT price FROM products WHERE id = $1', [productId]);
+  await chargeCard(req.user.paymentMethod, product.price);
+  ```
+- Quantities, currency, plan tiers, or seat counts accepted from the client and multiplied into totals without server-side lookup → same severity.
+- Coupons/discounts validated only on the client, or discount values sent by the client rather than looked up server-side → Critical.
+- Free-trial/trial-flag booleans trusted from request bodies → Critical (anyone posts `trial: true` forever).
+
+## Step 3 — Webhook signature verification (most-missed check)
+
+Every payment webhook route must verify authenticity BEFORE trusting or acting on its body:
+
+- Stripe: `stripe.webhooks.constructEvent(rawBody, sigHeader, process.env.STRIPE_WEBHOOK_SECRET)` with `express.raw({ type: 'application/json' })` on the route. No signature verification anywhere in the handler chain → Critical: anyone who finds the URL can POST a fake `payment_intent.succeeded` and get orders marked paid for free.
+- PayPal: `verify-webhook-signature` API call missing → Critical.
+- Razorpay: missing `verifyPaymentSignature` / HMAC comparison → Critical.
+- Firebase/custom webhooks: no shared-secret header compared server-side → Critical.
+- Also flag webhook handlers that fulfill orders based on amounts read from the unverified event payload instead of re-fetching them server-side.
+
+## Report
+
+Use the format, severity rubric, and final-summary structure from SKILL.md. Scope reminder: "payment-only check — secrets, .gitignore, authentication, database rules, IDOR, and input validation were skipped. This does not mean the app is production-ready. Run a full `/checkmyvibe` audit before launch, and get a professional security review before handling real money."

package/commands/checkmyvibe-secrets.md

@@ -1,3 +1,55 @@
-Read the checkmyvibe `SKILL.md`. Run only **Check 1 (exposed secrets and credentials)** and **Check 2 (.gitignore hygiene)** from that skill.
+# /checkmyvibe-secrets — Exposed secrets & .gitignore hygiene
 
-Use the same report format, severity rubric, and final summary structure defined in `SKILL.md`, but scope the final summary to note that this was a secrets-only check (Checks 3, 4, 5, 6, and 7 were skipped), not a full audit, and suggest running the full `/checkmyvibe` audit before launch.
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+Use SKILL.md **only** for the report format, severity rubric, and final-summary structure. The complete operating instructions for this scope are below — follow them even if SKILL.md cannot be found.
+
+**Optional argument:** a target directory may be passed after the command. Default to the project root if not given. Scripts live in the `scripts/` folder next to SKILL.md.
+
+## Scope
+
+This is a **secrets-only check**: Check 1a (server-side secrets) + Check 1b (client-exposed secrets) + Check 2 (.gitignore hygiene). Checks 3–7 are skipped and must be listed as skipped in the final summary.
+
+## Step 1 — Run both scripts
+
+```bash
+python <skill_dir>/scripts/scan_secrets.py <target>
+python <skill_dir>/scripts/check_gitignore.py <target>
+```
+
+If Python is unavailable or a script fails, say so explicitly in the report ("automated secret scan could not run; manually reviewed instead") and do the equivalent manually: grep for key prefixes (`sk_live_`, `sk_test_`, `AIza`, `AKIA`, `ghp_`, `xox[bp]-`) and literal assignments to names containing `key`, `secret`, `token`, `password`.
+
+## Step 2 — Triage every script finding
+
+The scripts over-match on purpose. For each hit, open the file and decide:
+
+- **Live Stripe key (`sk_live_...`)** → Critical. Charges real cards. Recommend immediate rotation at dashboard.stripe.com, not just deletion.
+- **Test Stripe key (`sk_test_...`) in source** → Should Fix. Not production-critical but must not be committed; rotate if the repo was ever shared/pushed publicly.
+- **AWS `AKIA`, Google `AIza`, GitHub `ghp_`, Slack tokens in source** → Critical. Recommend revoking at the provider console.
+- **Publishable keys (`pk_live`, `pk_test`, Supabase anon keys, Firebase apiKey config)** → NOT findings. These are public-by-design; say so in one line so the user isn't confused.
+- **Placeholders** (`your-api-key-here`, `<secret>`, dummy values) → not findings.
+- Anything inside test/fixture/mock directories → not findings (the scripts already skip these).
+
+## Step 3 — Client-exposure pass (Check 1b)
+
+Manually verify secrets aren't reachable from the browser:
+
+- Grep frontend code (`src/`, `app/`, `components/`, `pages/`, `public/`, client entry points) for references to secret env vars or service-role keys.
+- In Next.js: any secret used outside a server-only context, or a secret var incorrectly prefixed with `NEXT_PUBLIC_`. In Vite/CRA: secrets behind `VITE_*` / `REACT_APP_*` get bundled into shipped JS — Critical.
+- Supabase `service_role` key, Firebase admin SDK private key JSON, OpenAI/Stripe secret keys appearing anywhere client-reachable → Critical.
+
+## Step 4 — .gitignore hygiene (Check 2)
+
+From `check_gitignore.py` output plus manual review:
+
+- `.env` / `.env.local` present but not ignored → Critical regardless of contents.
+- No `.gitignore` at all with secret files present → Critical.
+- Run `git log --all --full-history -- .env` (if git available). If `.env` was ever committed → Critical, and state plainly: removing it now is not enough; every secret in git history must be rotated because history stays recoverable.
+
+## Report
+
+Use the format, severity rubric, and final-summary structure from SKILL.md. Scope reminder for this run: "secrets-only check — Checks 3 (auth), 4 (db), 5 (IDOR), 6 (inputs), and 7 (payments) were skipped. This does not mean the app is secure. Run a full `/checkmyvibe` audit before launch."

package/commands/checkmyvibe.md

@@ -1,3 +1,26 @@
-Read the checkmyvibe `SKILL.md`. Run a full production readiness and code quality audit across all checks (Checks 1 through 7: exposed secrets, .gitignore hygiene, missing/fake auth, database misconfigurations, IDOR/BOLA, unvalidated inputs, and client-side payment logic).
+# /checkmyvibe — Full production readiness audit
 
-Use the report format, severity rubric, and final summary structure defined in `SKILL.md`.
+First, locate the checkmyvibe skill file `SKILL.md`. Check these paths in order:
+
+1. `.claude/skills/checkmyvibe/SKILL.md` (project-level install)
+2. `~/.claude/skills/checkmyvibe/SKILL.md` (global install)
+3. If neither exists, search the working directory for a file named `SKILL.md` whose frontmatter contains `name: checkmyvibe`
+
+If it still cannot be found, tell the user and stop — do not improvise an audit without the skill definitions.
+
+**Optional argument:** a target directory may be passed after the command (e.g. `/checkmyvibe src/`). Default to the project root if not given.
+
+Then read `SKILL.md` in full and run the **complete audit: Checks 1a, 1b, 2, 3, 4, 5, 6, and 7**:
+
+- Check 1a — server-side secrets and credentials
+- Check 1b — client-exposed secrets
+- Check 2 — .gitignore hygiene (including git-history check for committed `.env`)
+- Check 3 — missing or fake authentication
+- Check 4 — database / BaaS misconfiguration (Supabase RLS, Firebase rules, storage)
+- Check 5 — broken object-level authorization (IDOR/BOLA), route by route
+- Check 6 — unvalidated inputs, SQLi/XSS risk, mass assignment, missing rate limiting on auth endpoints
+- Check 7 — client-side payment/pricing logic AND webhook signature verification
+
+Run every script in the skill's `scripts/` folder that maps to Checks 1–4 (`scan_secrets.py`, `check_gitignore.py`, `check_auth_patterns.py`, `check_db_config.py`) against the target directory before relying on your own reasoning. If Python is unavailable or a script fails, state that explicitly in the report and do the check manually instead of silently skipping it.
+
+Use the report format, severity rubric, evidence/confidence rules, post-fix verification step, and full-audit final summary structure defined in `SKILL.md`.

package/package.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json.schemastore.org/package.json",
   "name": "checkmyvibe",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "A structured production readiness and code quality workflow Agent Skill for AI coding assistants to catch common vibe-coded configuration issues.",
   "main": "install.js",
   "bin": {

package/scripts/check_auth_patterns.py

@@ -2,12 +2,22 @@
 import os
 import sys
 import re
+import fnmatch
 
 SKIP_DIRS = {
     'node_modules', '.git', 'build', 'dist', '.next', '.svelte-kit', 
-    '__pycache__', 'venv', '.venv', 'env', 'coverage', 'out'
+    '__pycache__', 'venv', '.venv', 'env', 'coverage', 'out',
+    # Test/support directories: mock auth there is intentional, not a finding
+    '__tests__', '__mocks__', '__snapshots__', 'tests', 'test', 'spec',
+    'fixtures', 'mocks', 'e2e', 'cypress', '.storybook'
 }
 
+TEST_FILE_PATTERNS = ['*.test.*', '*.spec.*', '*.stories.*', '*.mock.*']
+
+def is_test_file(filename):
+    """Skip unit-test/spec/story/mock files: stubbed auth there is expected."""
+    return any(fnmatch.fnmatch(filename, pat) for pat in TEST_FILE_PATTERNS)
+
 SKIP_EXTS = {
     '.png', '.jpg', '.jpeg', '.gif', '.ico', '.pdf', '.zip', '.tar', 
     '.gz', '.mp3', '.mp4', '.mov', '.db', '.sqlite', '.exe', '.dll',
@@ -98,7 +108,7 @@ def main():
         
         for file in files:
             ext = os.path.splitext(file)[1].lower()
-            if ext in SKIP_EXTS or file.startswith('.'):
+            if ext in SKIP_EXTS or is_test_file(file) or file.startswith('.'):
                 continue
                 
             file_path = os.path.join(root, file)

package/scripts/check_db_config.py

@@ -2,8 +2,18 @@
 import os
 import sys
 import re
+import fnmatch
 
-SKIP_DIRS = {'node_modules', '.git', 'dist', 'build'}
+SKIP_DIRS = {
+    'node_modules', '.git', 'dist', 'build',
+    '__tests__', '__mocks__', 'tests', 'test', 'spec', 'fixtures',
+    'mocks', 'e2e', 'cypress'
+}
+
+TEST_FILE_PATTERNS = ['*.test.*', '*.spec.*', '*.mock.*']
+
+def is_test_file(filename):
+    return any(fnmatch.fnmatch(filename, pat) for pat in TEST_FILE_PATTERNS)
 
 # Permissive rules patterns for Firestore and Firebase Storage
 FIREBASE_PERMISSIVE = re.compile(r'allow\s+[\w\s,]+:\s*if\s+true\s*;')
@@ -108,6 +118,8 @@ def main():
         dirs[:] = [d for d in dirs if d not in SKIP_DIRS and not d.startswith('.')]
         
         for file in files:
+            if is_test_file(file):
+                continue
             file_path = os.path.join(root, file)
             rel_path = os.path.relpath(file_path, target_dir)
             

package/scripts/scan_secrets.py

@@ -3,14 +3,24 @@ import os
 import sys
 import re
 import math
+import fnmatch
 
 # Directories to skip during scanning
 SKIP_DIRS = {
     'node_modules', '.git', 'build', 'dist', '.next', '.svelte-kit', 
     '__pycache__', 'venv', '.venv', 'env', 'coverage', 'out', '.expo',
-    '.output', '.nuxt'
+    '.output', '.nuxt',
+    # Test/support directories: mocked credentials here are expected, not leaks
+    '__tests__', '__mocks__', '__snapshots__', 'tests', 'test', 'spec',
+    'fixtures', 'mocks', 'e2e', 'cypress', '.storybook'
 }
 
+TEST_FILE_PATTERNS = ['*.test.*', '*.spec.*', '*.stories.*', '*.mock.*']
+
+def is_test_file(filename):
+    """Skip unit-test/spec/story/mock files: fake keys there are intentional."""
+    return any(fnmatch.fnmatch(filename, pat) for pat in TEST_FILE_PATTERNS)
+
 # File extensions to skip (binary/media/lockfiles/assets)
 SKIP_EXTS = {
     '.png', '.jpg', '.jpeg', '.gif', '.ico', '.pdf', '.zip', '.tar', 
@@ -20,12 +30,13 @@ SKIP_EXTS = {
     '.svg', '.css', '.scss', '.less', '.html', '.xml'
 }
 
-# Regexes for known API key formats
+# Regexes for known API key formats (live keys are Critical; test keys are Should Fix)
 API_KEY_PATTERNS = [
     (re.compile(r'AIza[0-9A-Za-z-_]{35}'), 'Google API Key'),
     (re.compile(r'AKIA[0-9A-Z]{16}'), 'AWS Access Key ID'),
     (re.compile(r'ghp_[a-zA-Z0-9]{36,40}'), 'GitHub Personal Access Token'),
-    (re.compile(r'sk_(live|test)_[0-9a-zA-Z]{24,96}'), 'Stripe Secret Key'),
+    (re.compile(r'sk_live_[0-9a-zA-Z]{24,96}'), 'Stripe LIVE Secret Key (Critical: charges real cards)'),
+    (re.compile(r'sk_test_[0-9a-zA-Z]{24,96}'), 'Stripe TEST Secret Key (Should Fix: not production-critical but must not be committed)'),
     (re.compile(r'xox[bapr]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32}'), 'Slack Token'),
 ]
 
@@ -134,7 +145,9 @@ def main():
         for file in files:
             ext = os.path.splitext(file)[1].lower()
             # Skip hidden files unless they are .env configuration files
-            if ext in SKIP_EXTS or (file.startswith('.') and not file.startswith('.env')):
+            if ext in SKIP_EXTS or is_test_file(file):
+                continue
+            if file.startswith('.') and not file.startswith('.env'):
                 continue
                 
             file_path = os.path.join(root, file)