Skills

Free skill for Claude Code and Codex

Break-In.

Break into your own app before a stranger does.

Then it closes every hole it got through, and proves it by trying again.

For apps built with Next.js, Supabase, Firebase, Stripe, Vite or Express.

Reading your app's code.A test app with six holes planted on purpose.

What it tries.

Everything a stranger would. It only reads, unless you say yes.

  1. Keys in your JavaScript

    Downloads your site's code and source maps, like anyone can.

  2. Keys in your git history

    Every line ever committed. Deleted isn't gone.

  3. Tables anyone can read

    Every Supabase table, with the key your website ships.

  4. Routes with no login

    Every API route and server action, called logged out.

  5. Someone else's data

    Your record, my session. Change the id, see what comes back.

  6. Fake payments

    A forged “payment succeeded” sent to your webhook.

  7. Prices from the browser

    Checkout with the price edited to 1 cent.

  8. Admin by user_metadata

    Users can edit it. Policies that trust it are open.

  9. Private files online

    /.env, /.git, SQL dumps and .npmrc, served by mistake.

  10. The middleware skip

    One header that walks past Next.js middleware (CVE-2025-29927).

  11. Open buckets and rules

    Storage you can list, Firebase rules left on “if true”.

  12. No limit on AI routes

    25 quick requests. A loop on their side is a bill on yours.

Closed means the same attack bounced.

curl -si https://yourapp.com/api/notes

Before the fix
HTTP/1.1 200 OK[{ id, user_id, email, body }, … ]
After, the same request
HTTP/1.1 401 Unauthorized{ "error": "unauthorized" }

The fix, in app/api/notes/route.ts: getUser() first, then only the user's own notes.

  • Every attack is saved and sent again after the fix.
  • Leaked keys: it tells you where to rotate them. Deleting isn’t enough.
  • Your tests and build run after every fix. Nothing breaks quietly.

Find it first.

  1. 1Get it free
  2. 2Open it in Claude Code
  3. 3Say: break into my app

Only attacks apps you own. Needs Claude Code or Codex, Node.js 18 or newer, and git. Mac, Windows or Linux.