zexahq/better-auth-starter

2 findings

1 medium1 low

• Mediumlow confidenceServer Action loginUser (src/app/auth/login/action.ts) has no validator or rate limiter attached.

  Server Action loginUser (src/app/auth/login/action.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/app/auth/login/action.ts:7

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function loginUser(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Lowlow confidenceGET /api/admin/users has no validator or rate limiter attached.

  GET /api/admin/users can be called at any rate. Cheap to fix, rarely urgent on a read.

  Where

  src/app/api/admin/users/route.ts:4

  Missing

  A rate limit.

  Confidence

  Inline validation (zod.parse, pydantic models) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  // 60 requests per IP per minute.
  app.get("/api/admin/users", rateLimit({ windowMs: 60_000, limit: 60 }), handler);

  Intended? If validation and rate limiting happen upstream (an API gateway, Vercel Firewall), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

Free account, no card. The repository opens as an editable graph.