Security report · sample
Invoicing app for freelancers
Replit · Express · Postgres · built with Replit
zebrazones/example-invoice-desk commit 9d9bf37 scanned 2026-09-27
Fix now
Two problems need fixing today: your Stripe secret key is handed to every visitor's browser, and any signed-in customer can open other customers' invoices. A few more issues should follow close behind.
- 2
- critical
- 2
- high
- 2
- medium
- 0
- low
What we checked
Can one user reach another user's data?
Needs attention- Any customer can open other customers' invoices Critical
The invoice page loads whatever ID is in the address bar without checking it belongs to the person asking. Change the number in the URL and you see someone else's invoice, including their client's name, email and amounts.
The fix: Only return an invoice when it belongs to the signed-in user; otherwise respond as if it doesn't exist.
server/routes.ts:30
Can someone bypass signing in?
Needs attention- A built-in fallback password protects login sessions High
If the app is started without its session secret set, it silently uses a fixed value baked into the code. Anyone who knows it can forge a login cookie and sign in as any user.
The fix: Require the session secret at startup and refuse to run without it, so there is no guessable fallback.
server/auth.ts:40
Can an attacker run their own commands or database queries?
No issuesNothing to fix here.
Are any passwords or secret keys exposed?
Needs attention- Your Stripe secret key is sent to every visitor Critical
The private Stripe key is bundled into the code that runs in each visitor's browser. Anyone who opens the app can read it and use it to move money and read payment data from your Stripe account.
The fix: Keep the secret key on the server only and have the browser call your server, never Stripe directly, for payments.
client/src/lib/stripe.ts:5
Can the app's requests be abused?
Needs attention- The AI invoice generator has no usage limit Medium
The endpoint that calls OpenAI has no cap, so someone could call it in a loop and run up your AI bill.
The fix: Add a per-user rate limit and a sensible size cap on that endpoint.
server/routes.ts:86
Can uploaded files or user input cause trouble?
No issuesNothing to fix here.
Can normal users reach admin features?
Needs attention- Any signed-in user can use the admin features High
The admin endpoints check that you are logged in, but not that you are an admin. Any ordinary customer can call them and reach data and actions meant for staff only.
The fix: Check for an admin role on every admin endpoint, not just that the caller is signed in.
server/routes.ts:100
Are important actions missing abuse protection?
Needs attention- No limit on login and sign-up attempts Medium
Login and registration accept unlimited attempts, so an attacker can guess passwords or create accounts in bulk without being slowed down.
The fix: Add rate limiting and a lockout after repeated failures on login and registration.
server/auth.ts:104
This is a sample report on a deliberately built demo app, shown in full so you can see exactly what you would receive. Real reports are private to you.