// wrote this at 2am with Cursor // probably fine?
app.post('/api/users', (req, res) => { const query = `SELECT * FROM users
WHERE email = '${req.body.email}'`;
db.exec(query);
});
You vibe-coded it. The AI didn't mention the SQL injection.
AuditDrop
Upload your code. Get a security audit.
1
Drop your ZIP
2
AI reads every file
3
Get findings in minutes
Scan complete
2m 14s
2 critical
5 high
8 medium
3 low
CRITICAL
SQL Injection in user query
src/routes/users.ts:47 · CWE-89
CRITICAL
Hardcoded database credentials
src/config/db.ts:3 · CWE-798
HIGH
Missing authentication on admin routes
src/routes/admin.ts:12 · CWE-306
HIGH
JWT secret in source code
src/lib/auth.ts:8 · CWE-798
MEDIUM
Missing rate limiting on auth endpoints
src/routes/auth.ts:1 · CWE-307
CRITICAL
SQL Injection in user query
src/routes/users.ts:47 · CWE-89
User input is interpolated directly into a SQL query string without parameterization, allowing an attacker to execute arbitrary SQL.
Recommendation
Use parameterized queries with placeholders instead of string interpolation. Pass user input as bound parameters so the database driver handles escaping, preventing injected SQL from being executed.
⌨️
Vibe code with Cursor / Copilot
→
🔍
Audit with AuditDrop
→
🔧
Fix paste findings back in
→
🚀
Ship with confidence
Every finding is a prompt. Feed it back into your AI — it fixes itself.
$0.75
per 1,000 lines of code
No subscription. Pay per scan.
Not a linter. Not a SAST tool. An actual code review.
AI reads your code like a senior security engineer would.
Coming soon.
AuditDrop
Upload your code. Get a security audit. Under ten minutes.