security-vite

Name: security-vite
Availability: InStock
Author: Howaboua

Audit Vite applications for exposed secrets and insecure configurations.

124|12|Updated Nov 17, 2025

Search Tags:#security #web development #vulnerability #javascript #audit #vite

Ready to run

npx skills add https://github.com/IgorWarzocha/Opencode-Workflows --skill security-vite-igorwarzocha

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-vite
Source: https://github.com/IgorWarzocha/Opencode-Workflows/tree/main/agents/security-reviewer/.opencode/skill/security-vite
Command: npx skills add https://github.com/IgorWarzocha/Opencode-Workflows --skill security-vite-igorwarzocha

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps developers identify and mitigate common security vulnerabilities in Vite-based web applications, preventing sensitive data leaks and improving overall application security.

Core Features & Use Cases

Environment Variable Auditing: Detects the exposure of secrets through VITE_ prefixed variables.
Build Configuration Review: Checks for insecure settings in vite.config.ts, such as exposing secrets during the build process or enabling source maps in production.
Dev Server Security: Identifies risks like exposing the development server to the network.
SPA Security Checks: Reviews client-side authentication patterns and potential secret leakage in bundled code.
Use Case: Before deploying a new Vite application, run this Skill to perform a comprehensive security audit, ensuring no critical vulnerabilities are present.

Quick Start

Run a security audit on the current Vite project.

Frequently Asked Questions about security-vite

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit my Vite application for exposed environment variables?▼

To audit Vite environment variables, you must check for secrets prefixed with VITE_, as these are exposed to the client. This Skill automates scanning .env files and build outputs to detect exposed API keys.

What are common security vulnerabilities in Vite single page applications?▼

Common Vite SPA security vulnerabilities include leaking build-time secrets, exposing API keys via VITE_ prefixed variables, and insecure dev server configurations. Source maps in production builds also risk exposing bundled code.

How do I check vite.config.ts for insecure build configurations?▼

You can check vite.config.ts for insecure build configurations by reviewing settings that expose secrets during the build process or enable production source maps. This Skill analyzes your config to identify these risks.

Does this security audit work on the production build output of a Vite app?▼

Yes, the security audit works on the production build output by analyzing the bundled code for critical issues like exposed API keys and client-side secret leakage. It uses shell scripts with grep and rg for automated scanning.

Can I use this to find secrets leaked into client-side JavaScript bundles?▼

Yes, you can use this to find secrets leaked into client-side JavaScript bundles by reviewing SPA security patterns and scanning the production build output. It detects sensitive data exposed through environment variables.