Reference
What each finding means.
One page per thing we check. Each covers what it is and how to fix it, plus the two things a finding itself cannot tell you: how to confirm the fix actually worked, and the mistake people make while applying it.
Credentials and keys
Your Supabase anon key is public — and that is fine
/supabase-anon-key
Why the key in your bundle is not the problem, and what actually is.
A service_role key in browser code
/supabase-service-role
The most severe finding we issue, and what to do in the next ten minutes.
A credential in your browser bundle
/client-secrets
How it gets there, why rotation comes first, and how to stop it recurring.
An exposed AI provider key
/llm-key-exposure
A billing problem before it is a security problem.
Secrets in NEXT_PUBLIC_ and VITE_ variables
/public-env-vars
Why the variable name alone is the bug.
Keys that are meant to be public
/public-keys
The ones other scanners flag and shouldn’t.
Where to keep a login token
/token-storage
localStorage is readable by every script on your page. A cookie need not be.
Database credentials are not the same as public keys
/managed-db-keys
A Supabase anon key is meant to ship. A Mongo, Turso or Prisma key is not.
Search engines need a search-only key in the browser
/search-exposure
Master keys can rewrite and delete every index. Use a scoped key instead.
Databases and storage
Enabling Row Level Security without breaking your app
/supabase-rls
The one-line fix, the policy it needs, and the mistake that takes your app down.
Your table names are in your JavaScript
/schema-exposure
Why you cannot hide them, and why that is not the thing to fix.
Firebase config in your bundle
/firebase-config
Public by design. Your rules are what matter.
Firebase security rules that actually restrict
/firebase-rules
Default-deny, then allow what your app needs.
Public storage buckets and file access
/supabase-storage
Bucket names are the hard part of finding your users’ uploads.
Public buckets versus listable buckets
/bucket-listing
Two different settings, and the second is almost never intended.
Database functions callable without logging in
/rpc-exposure
Why RLS does not protect a SECURITY DEFINER function.
PocketBase collections are public until you set a rule
/pocketbase-rules
A blank API rule means anyone can list the collection. Blank is the default.
Appwrite has a role called Any, and it means anyone
/appwrite-permissions
Collection permissions decide who reads your data. One of the roles is the whole internet.
Every Convex function you export is callable by anyone
/convex-functions
There is no rules layer. The authorisation check has to be inside each function.
The Directus Public role is what anonymous visitors get
/directus-permissions
Anything the Public role can read is readable by the internet, with no token.
A Hasura admin secret in browser code bypasses everything
/hasura-permissions
The admin secret ignores every permission rule. It must never reach the browser.
Access control
Endpoints that trust the ID in the URL
/idor
The most common serious flaw in AI-built CRUD apps.
A login screen is not an access control
/auth-coverage
Why we cannot test this for you without permission, and how to test it yourself.
A hidden button is not a permission
/client-authz
The most common serious flaw in AI-built admin areas.
Tables your app never queries
/api-surface
The ones nobody reviews, carrying whatever permissions they were made with.
The endpoints your app publishes
/api-inventory
Most people have never seen a list of their own API routes.
Transport and browser hardening
Your HTTPS certificate
/tls
The only finding here that predicts an outage rather than a breach.
The five response headers worth setting
/security-headers
What each one stops, and where to put them.
Making a Content-Security-Policy actually do something
/csp
A policy is easy to have and easy to make meaningless.
HttpOnly, Secure, and SameSite
/cookie-flags
Three words that decide how bad a script injection turns out to be.
A wildcard CORS policy with credentials
/cors
Why this specific combination is a real hole.
HTTP resources on an HTTPS page
/mixed-content
Some of these are silently broken for your visitors already.
What your build leaks
Source maps in production
/source-maps
Not a hole by itself. It removes all the effort from finding one.
A .env or .git served publicly
/exposed-files
The whole account, not one key.
Development leftovers in production
/debug-artifacts
Individually harmless, collectively a signal.
Patterns worth a second look
/client-risk
Why we point at these rather than accuse them.
End-of-life libraries
/outdated-libraries
We report support status, not vulnerabilities. Here is why that distinction matters.
Doors nobody meant to open
Debug mode in production is the worst single setting
/framework-debug
A debug error page shows your source, your config, and often your environment variables.
Metrics, Actuator and pprof are for you, not for the internet
/debug-endpoints
Monitoring endpoints are added by a dependency and exposed by the default route.
Admin tools do not belong on the public internet
/admin-ui-exposed
phpMyAdmin, Adminer and friends are permanent targets. Restrict them, do not just password them.
Public API docs hand over the whole map
/api-docs-exposed
Swagger and OpenAPI pages list every route, parameter and field name you have.
Domain and email
Privacy and third parties
Every script tag is a company you trusted
/third-party-scripts
What an external script can actually do on your page.
Personal details hardcoded in code
/client-pii
Scraped within days, and we do not repeat the values back to you.
Cookies, consent, and the pages you need
/privacy-compliance
The rule most commonly enforced, and the simplest way to avoid it entirely.
Findable and usable
When Google cannot see your app at all
/seo-blocking
Two settings that make a working site invisible. Both are free to check, forever.
Title, description, canonical
/seo-basics
The three tags that decide how you appear in a search result.
Headings and image descriptions
/seo-structure
The outline search engines and screen readers both read.
Link preview cards
/seo-social
The most visible item on any SEO list.
Sitemaps, robots, and redirects
/seo-crawlability
Helping a crawler find everything without guessing.
What makes an AI-built app slow
/performance
Measured from what we downloaded, so no lab conditions involved.
Accessibility basics
/accessibility
Increasingly a legal requirement, and mostly structural.