Security report · sample
Booking tool for fitness studios
Cursor · Next.js · Prisma · built with Cursor
zebrazones/example-studio-slot commit 46edc30 scanned 2026-09-27
Fix when you can
No break-in and no leaked member data. What remains makes an attacker's job easier: spammable bookings, reusable reset links, chatty errors. Worth fixing in the next few weeks, not tonight.
- 0
- critical
- 0
- high
- 3
- medium
- 1
- low
What we checked
Can one user reach another user's data?
No issuesNothing to fix here.
Can someone bypass signing in?
Needs attention- Password reset links stay valid for 7 days and work more than once Medium
A reset link keeps working for a week and is not used up when someone sets a new password. Anyone who later gets hold of the email, for example on a shared or compromised inbox, can use the same link again to take over the account.
The fix: Delete the reset token as soon as it is used, and let links expire after about an hour.
src/app/api/auth/reset-password/route.ts:15 - Sign-in reveals whether an email address is registered Low
Sign-in answers "No account found" for unknown emails and "Incorrect password" for known ones. Anyone can use that to check which people are members of the studio.
The fix: Return the same message for a wrong email and a wrong password.
src/app/api/auth/signin/route.ts:20
Can an attacker run their own commands or database queries?
No issuesNothing to fix here.
Are any passwords or secret keys exposed?
No issuesNothing to fix here.
Can the app's requests be abused?
Needs attention- Error responses leak Prisma queries and table names Medium
When a database call fails, the API sends the full Prisma error back to the browser, including the query, table and field names and a stack trace with server file paths. That is a map of your database for anyone probing the app.
The fix: Log the full error on the server and send the browser a short, generic message.
src/lib/api.ts:18
Can uploaded files or user input cause trouble?
No issuesNothing to fix here.
Can normal users reach admin features?
No issuesNothing to fix here.
Are important actions missing abuse protection?
Needs attention- No rate limit on bookings, a script can fill a whole class schedule Medium
The booking endpoint accepts any number of classes in one request, with no cap per member and no rate limit. One free account can book every spot in every class in seconds, and real members find everything full.
The fix: Cap how many upcoming classes a member can hold, limit the size of a series booking, and rate-limit the booking endpoint.
src/app/api/bookings/route.ts:29
This is a sample report on a deliberately built demo app, shown in full so you can see exactly what you would receive. Real reports are private to you.