security-vite

Audit Vite applications for environment variable exposure and build-time secrets.

Updated Feb 9, 2025

Search Tags:#security #vulnerability #audit #vite #env vars #build config

Ready to run

npx skills add https://github.com/xeon826/dotfiles --skill security-vite-xeon826

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-vite
Source: https://github.com/xeon826/dotfiles/tree/main/opencode/skill/security-vite
Command: npx skills add https://github.com/xeon826/dotfiles --skill security-vite-xeon826

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires ripgrep, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps developers identify and mitigate common security vulnerabilities in Vite-powered applications, protecting against data leaks and unauthorized access.

Core Features & Use Cases

Environment Variable Auditing: Detects exposure of sensitive information through VITE_* variables.
Build Configuration Review: Analyzes vite.config.ts for insecure settings like exposed secrets or production source maps.
Dev Server Security: Checks for insecure host bindings or misconfigured proxies in the development server.
Bundle Scanning: Scans the production build output (dist/) for leaked secrets or API keys.

Quick Start

Use the security-vite skill to audit Vite env vars for secrets.

Frequently Asked Questions about security-vite

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Vite environment variables for exposed secrets?▼

To audit Vite environment variables for exposed secrets, scan your project for `VITE_*` variables that leak sensitive information. This Skill checks `vite.config.ts` and optionally the `dist/` directory to identify exposed API keys or secrets bundled during production builds.

What are common Vite security vulnerabilities in production builds?▼

Common Vite security vulnerabilities in production builds include leaking secrets via `VITE_*` environment variables, insecure `define` usage in `vite.config.ts`, and exposed API keys in the `dist/` directory. Misconfigured development servers also expose applications to unauthorized access.

How do I check my Vite dev server for misconfigurations?▼

To check your Vite dev server for misconfigurations, review host bindings and proxy settings. This Skill identifies insecure host bindings and misconfigured proxies within the development server to protect against unauthorized access during local development.

Does this Vite security audit require ripgrep to run?▼

Yes, this Vite security audit requires `ripgrep` as a dependency to scan files efficiently. It also requires a `vite.config.ts` file in your project to properly analyze build-time configurations and insecure `define` usage.

How do I scan my Vite production bundle for leaked API keys?▼

To scan your Vite production bundle for leaked API keys, analyze the `dist/` directory output. This Skill searches built files for exposed secrets, API keys, and `VITE_*` variable leakage that may have been included during the build process.

What is insecure define usage in vite.config.ts?▼

Insecure `define` usage in `vite.config.ts` occurs when sensitive secrets or environment variables are hardcoded into global definitions. This exposes them to the client bundle, and this Skill identifies such risks during build configuration review.