slopseclisted

# slopsec Security review built for **vibe-coded SaaS slop**: apps shipped fast with AI assistance, where the gap between "it works" and "it's safe to expose to the internet" is where attackers live. The premise of the source material is simple — a freshly launched app got probed by an attacker within 3 hours. Bots scan the whole IPv4 space constantly; "nobody knows my URL yet" is not a defense. This skill turns 50 recurring failure modes into a repeatable audit. Use it to **review** existing code or **harden** before a launch. ## How to use this skill 1. **Scope it.** Identify the stack (frontend framework, backend, database, auth provider, hosting) and where secrets live. Most slop vulns cluster around Supabase/Firebase rules, missing server-side authz, and leaked env. 2. **Run the audit.** Walk every item in `references/checklist.md`. For each, either confirm it's handled or flag it. Don't skip categories because the app "looks fine" — the dangerous bugs are invisible from the UI. 3. **Prove the findings.** Where safe and authorized, demonstrate the issue (e.g. fetch another user's row via the API, hit an admin route unauthed, grep the built JS bundle for secrets). A demonstrated bug gets fixed; a theoretical one gets argued about. 4. **Prioritize.** Score each finding by `references/severity.md`. Lead with the catastrophic, instantly-exploitable ones (exposed creds, missing authz, open DB rules). Don't bury a P0 IDOR under a missing security