Securie for Astro
Securie reviews every Astro build and every server-endpoint change. Common Astro-specific bugs (unauthenticated `/src/pages/api` handlers, missing CSRF on Astro Actions, client-exposed env vars) are covered on day one.
Why it matters for Astro
Install the Securie GitHub App on your Astro repository. Every pull request is reviewed for server-endpoint auth gaps, env-var leakage through `PUBLIC_` prefixes, and misconfigured server actions.
- Covers the Astro server-endpoint surface (Node.js + edge adapters)
- Detects `PUBLIC_` env-var leaks in the client bundle
- Audits `defineAction()` handlers for missing auth
- Integrates with Vercel, Netlify, and Cloudflare Pages deploys
Common bugs we catch in Astro
Unauthenticated API endpoints
Astro's `src/pages/api/` routes ship as unauthenticated by default. Securie flags endpoints with write side-effects but no session check.
Read the guide →PUBLIC_ env var containing a secret
Astro's `PUBLIC_*` vars ship to the client. Any key mistakenly prefixed is in every user's browser.
Read the guide →Missing CSRF on Astro Actions
`defineAction()` handlers without Astro's CSRF middleware are vulnerable to cross-origin POSTs. Securie detects missing setup.
Content Security Policy not configured
Astro's default template ships without a CSP. Securie proposes a strict CSP keyed to your declared script sources.
Install in under a minute
- Install the Securie GitHub App on your Astro repository
- Securie detects astro.config.mjs + your adapter automatically
- Push any change. Findings arrive as PR comments.
Astro is a trademark of The Astro Technology Company. Securie is independent.