Vibe code with confidence.
Ship your Cursor / Lovable / Bolt app knowing it is secure. Strix checks it and fixes what it finds.
Sign in with GitHub. Takes a minute.
Trusted by security teams at
Security at the speed you build.
Strix checks your app, explains what it found in plain English, and opens the fix as a PR. You merge. Done.
- Only real issues. No noise.
- Fix PR you can merge in one click.
- Rechecked after you merge, free.
Your users table was open to anyone
Emails and reset tokens of 40k users could be read without logging in. Strix turned on the right Supabase rules and rechecked.
- Found on the first check
- Fix PR opened, 12 lines
- Rechecked after merge. Safe.
What we catch
The things that slip through when you ship fast.
Open database tables
User data anyone can read without logging in.
Login you can skip
Pages and APIs that work without signing in.
Other people's data
Change an ID in the URL, see someone else's order.
Keys in the frontend
Stripe or OpenAI keys anyone can copy.
Unprotected AI features
Your AI endpoint running up your bill for strangers.
Payments you can fake
Orders marked paid without a real payment.
How it works
No security team needed. No sales call.
Connect GitHub
Repo, live URL, or both.
Strix checks it
Every page, API, and flow, the way a real user would.
Merge the fix
Fix PR opens. We recheck for free.
Fix included
Every issue comes with a PR. Merge it like any other.
SSRF via URL Parameter in /api/proxy
TL;DR
The /api/proxy endpoint accepts a user-supplied URL without validation. An attacker can access internal services, read cloud metadata, and exfiltrate credentials.
Impact
Access to cloud metadata at 169.254.169.254, potential credential theft, and internal network scanning.
Location
acme/api · proxy-handler.ts:23Severity
CVSS
8.6Fix Effort
LowDiscovered
2h agoDiscover & Validate
Checks your whole app, every time you ship. Only tells you about issues that are real, ranked by what matters.
How do I fix it?
Validate and restrict the target URL using an allowlist of permitted hostnames. Reject private/internal IP ranges and enforce HTTPS-only.
| 23 | 23 | const targetUrl = req.query.url; |
| 24 | const resp = await fetch(targetUrl); | |
| 24 | const parsed = new URL(targetUrl); | |
| 25 | if (!ALLOWED_HOSTS.has(parsed.hostname)) { | |
| 26 | throw new ForbiddenError("blocked"); | |
| 27 | } | |
| 28 | const resp = await fetch(parsed.href); | |
| 25 | 29 | return res.json(await resp.json()); |
Auto-Fix
Writes the fix, checks that it works, and opens the PR. Review, merge, done.
Vibe coded in
- Cursor
- Lovable
- Bolt
- v0
- Replit
- Claude Code
- Windsurf
- Codex
Running on
- Next.js
- Supabase
- Firebase
- Vercel
- Stripe
- Clerk