skills.rest
IgorWarzocha
IgorWarzochaCOMMUNITY
Explore all skills by this author →
Website𝕏@HowabouaGitHub

security-vite

Audit Vite applications for exposed secrets and insecure configurations.

124|12|Updated Nov 17, 2025
Search Tags:#security#web development#vulnerability#javascript#audit#vite
One-click install
npx skills add https://github.com/IgorWarzocha/Opencode-Workflows --skill security-vite-igorwarzocha
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-vite
Source: https://github.com/IgorWarzocha/Opencode-Workflows/tree/main/agents/security-reviewer/.opencode/skill/security-vite
Command: npx skills add https://github.com/IgorWarzocha/Opencode-Workflows --skill security-vite-igorwarzocha

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps developers identify and mitigate common security vulnerabilities in Vite-based web applications, preventing sensitive data leaks and improving overall application security.

Core Features & Use Cases

  • Environment Variable Auditing: Detects the exposure of secrets through VITE_ prefixed variables.
  • Build Configuration Review: Checks for insecure settings in vite.config.ts, such as exposing secrets during the build process or enabling source maps in production.
  • Dev Server Security: Identifies risks like exposing the development server to the network.
  • SPA Security Checks: Reviews client-side authentication patterns and potential secret leakage in bundled code.
  • Use Case: Before deploying a new Vite application, run this Skill to perform a comprehensive security audit, ensuring no critical vulnerabilities are present.

Quick Start

Run a security audit on the current Vite project.

Frequently Asked Questions about security-vite

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I audit my Vite application for exposed environment variables?▼

To audit Vite environment variables, you must check for secrets prefixed with VITE_, as these are exposed to the client. This Skill automates scanning .env files and build outputs to detect exposed API keys.

What are common security vulnerabilities in Vite single page applications?▼

Common Vite SPA security vulnerabilities include leaking build-time secrets, exposing API keys via VITE_ prefixed variables, and insecure dev server configurations. Source maps in production builds also risk exposing bundled code.

How do I check vite.config.ts for insecure build configurations?▼

You can check vite.config.ts for insecure build configurations by reviewing settings that expose secrets during the build process or enable production source maps. This Skill analyzes your config to identify these risks.

Does this security audit work on the production build output of a Vite app?▼

Yes, the security audit works on the production build output by analyzing the bundled code for critical issues like exposed API keys and client-side secret leakage. It uses shell scripts with grep and rg for automated scanning.

Can I use this to find secrets leaked into client-side JavaScript bundles?▼

Yes, you can use this to find secrets leaked into client-side JavaScript bundles by reviewing SPA security patterns and scanning the production build output. It detects sensitive data exposed through environment variables.

Related Skills

Explore More Software Engineering Skills→
OpenAEC-FoundationOpenAEC-Foundation
4

vite-agents-project-scaffolder

Generate Vite project scaffolds with configuration and starter files.

Official
Advanced
LiamVDB1LiamVDB1

django-security

Configure Django production settings with security headers and environment variables.

Community
Advanced
eliottbusinesseliottbusiness

requesting-code-review

Automate pre-commit code review with static analysis and security scanning.

Community
Advanced
AcczdyAcczdy
2

performing-web-application-penetration-test

Automate web application penetration testing following the OWASP WSTG with Burp Suite.

Community
Advanced