What a VCX audit actually gives you

EVIDENCE

The handler concatenates searchParams.get("q") directly into a raw SQL string before calling db.query().

WHY IT MATTERS

AI-generated CRUD endpoints often look harmless in demos. In production, this pattern can leak customer data or allow destructive queries.

FIX DIRECTION

Use parameterized queries and validate the accepted search shape before it reaches the database layer.

EVIDENCE

The route checks for a session, then deletes by project id without verifying that project.userId matches session.user.id.

WHY IT MATTERS

This is the classic vibe-coded auth bug: login exists, but authorization is missing where the dangerous action happens.

FIX DIRECTION

Scope the delete query by both project id and authenticated user id, then return 404 for non-owned records.

EVIDENCE

The component loads projects, then fetches findings separately inside a loop for each project card.

WHY IT MATTERS

It works with three demo rows. It becomes slow and expensive once a real user has a few dozen scans.

FIX DIRECTION

Fetch aggregated finding counts in one query and pass the summary into the dashboard cards.

EVIDENCE

The file contains formatting helpers, auth helpers, validation rules, and billing constants in one shared module.

WHY IT MATTERS

AI assistants frequently dump convenient helpers into one file. That makes future changes riskier because everything imports everything.

FIX DIRECTION

Split auth, billing, formatting, and validation helpers into focused modules before the dependency graph hardens.