Audit Vite applications for environment variable exposure and build-time secrets.
npx skills add https://github.com/xeon826/dotfiles --skill security-vite-xeon826
Please help me install this Agent Skill. Skill: security-vite Source: https://github.com/xeon826/dotfiles/tree/main/opencode/skill/security-vite Command: npx skills add https://github.com/xeon826/dotfiles --skill security-vite-xeon826
This Skill helps developers identify and mitigate common security vulnerabilities in Vite-powered applications, protecting against data leaks and unauthorized access.
VITE_* variables.vite.config.ts for insecure settings like exposed secrets or production source maps.dist/) for leaked secrets or API keys.Use the security-vite skill to audit Vite env vars for secrets.
High-intent search queries and answers about installing and using this skill.
To audit Vite environment variables for exposed secrets, scan your project for `VITE_*` variables that leak sensitive information. This Skill checks `vite.config.ts` and optionally the `dist/` directory to identify exposed API keys or secrets bundled during production builds.
Common Vite security vulnerabilities in production builds include leaking secrets via `VITE_*` environment variables, insecure `define` usage in `vite.config.ts`, and exposed API keys in the `dist/` directory. Misconfigured development servers also expose applications to unauthorized access.
To check your Vite dev server for misconfigurations, review host bindings and proxy settings. This Skill identifies insecure host bindings and misconfigured proxies within the development server to protect against unauthorized access during local development.
Yes, this Vite security audit requires `ripgrep` as a dependency to scan files efficiently. It also requires a `vite.config.ts` file in your project to properly analyze build-time configurations and insecure `define` usage.
To scan your Vite production bundle for leaked API keys, analyze the `dist/` directory output. This Skill searches built files for exposed secrets, API keys, and `VITE_*` variable leakage that may have been included during the build process.
Insecure `define` usage in `vite.config.ts` occurs when sensitive secrets or environment variables are hardcoded into global definitions. This exposes them to the client bundle, and this Skill identifies such risks during build configuration review.
johnlindquistAudit and upgrade insecure npm, yarn, or pnpm dependencies.
nguyenpv1980-wqVerify Vite production bundles for secret leakage and preview parity.
icartshAnalyze .NET solutions for code quality, security, and dependency issues.
dapperdiversAudit HTTP response headers and cookie attributes for missing security controls.