ubon
Version:
Security scanner for AI-generated apps (Cursor, Lovable, Windsurf, v0). Catches hardcoded secrets, prompt injection, hallucinated imports, Server Actions / Edge runtime mistakes, and the vibe-coded vulnerabilities traditional linters miss.
13 lines • 505 B
TypeScript
import { Rule } from '../types';
/**
* AI008: Unbounded LLM call (no max_tokens, no input length validation).
*
* Combines two cost-amplification footguns:
* 1. `max_tokens` / `maxOutputTokens` is unset → response can run to the
* provider hard limit.
* 2. The user-supplied prompt is forwarded verbatim with no length check
* → attackers stuff in megabytes of context and rack up token bills.
*/
declare const rule: Rule;
export default rule;
//# sourceMappingURL=AI008.d.ts.map