Erzo Sample Report

acme-storefront

April 15, 2026 • full scan • Sample Data

Fix Issues with AI

Download a report optimized for Lovable, Claude, ChatGPT, Cursor, or any AI coding assistant

Score

42

Critical

3

High

4

Medium

5

Low

2

Findings (15)

critical

Hardcoded AWS Secret Key in config.ts

An AWS secret access key was found in plain text. This grants programmatic access to AWS services and could lead to full cloud account compromise.

src/config/aws.ts:14

💡 Move the secret to environment variables or a secrets manager like AWS Secrets Manager.
critical

SQL Injection in user search endpoint

User input is concatenated directly into a SQL query string without parameterization, allowing an attacker to execute arbitrary SQL.

src/api/users.ts:87

💡 Use parameterized queries or an ORM instead of string concatenation.
critical

Missing authentication on admin API route

The /api/admin/users endpoint does not verify authentication tokens, allowing unauthenticated access to user management functions.

src/api/admin/users.ts:5

💡 Add authentication middleware to verify JWT tokens before processing requests.
critical

AI Package Hallucination: 'loda-sh'

The AI suggested installing 'loda-sh', which is a known hallucinated package name. This could be registered by an attacker to execute malicious code (Supply Chain Attack).

package.json:12

💡 Replace 'loda-sh' with the correct package name: 'lodash'.
high

Cross-Site Scripting (XSS) via dangerouslySetInnerHTML

User-generated content is rendered using dangerouslySetInnerHTML without sanitization.

src/components/CommentSection.tsx:42

💡 Use a sanitizer like DOMPurify before rendering user HTML content.
high

Missing Content-Security-Policy header

The application does not set a Content-Security-Policy header, making it vulnerable to XSS and data injection attacks.

💡 Add a strict CSP header: Content-Security-Policy: default-src 'self'; script-src 'self'
high

RLS not enabled on 'orders' table

Row Level Security is not enabled on the orders table, meaning any authenticated user can read/modify all orders.

💡 Enable RLS: ALTER TABLE orders ENABLE ROW LEVEL SECURITY; then add appropriate policies.
high

Insecure direct object reference in order details

The order detail endpoint uses the order ID from URL params without verifying ownership.

src/api/orders/[id].ts:12

💡 Add ownership check: verify order.user_id matches the authenticated user.
medium

No rate limiting on login endpoint

The login API does not implement rate limiting, making it vulnerable to brute-force credential attacks.

src/api/auth/login.ts:1

💡 Implement rate limiting (e.g., 5 attempts per minute per IP) using a middleware.
medium

Outdated dependency: lodash@4.17.19

lodash 4.17.19 has a known prototype pollution vulnerability (CVE-2021-23337).

package.json

💡 Update lodash to >=4.17.21 to patch the vulnerability.
medium

Session tokens stored in localStorage

Authentication tokens are stored in localStorage which is accessible via XSS. Consider using httpOnly cookies.

src/lib/auth.ts:23

💡 Use httpOnly cookies for token storage or at minimum, use sessionStorage.
medium

Missing X-Frame-Options header

The application doesn't set X-Frame-Options, potentially allowing clickjacking attacks.

💡 Set X-Frame-Options: DENY or SAMEORIGIN in your server responses.
medium

Error messages expose stack traces

Unhandled errors return full stack traces to the client, potentially revealing internal paths and dependencies.

src/api/middleware/errorHandler.ts:8

💡 Return generic error messages in production; log detailed errors server-side only.
low

CORS allows wildcard origin

Access-Control-Allow-Origin is set to '*', which may not be appropriate for authenticated APIs.

src/api/server.ts:15

💡 Restrict CORS to specific trusted origins instead of using wildcard.
low

Console.log statements in production code

Multiple console.log statements found that could leak sensitive data to browser developer tools.

src/api/payments.ts:34

💡 Remove or replace console.log with a proper logging library that respects log levels.
Generated by Erzo • Sample Report