ascertify/learn

The findings, explained

Plain-English guides to the issues a code scan finds in AI-built and agency-delivered apps. What each one means, how serious it really is, and how to fix it, written for the founder who owns the app, not the developer who built it.

Am I exposed?

Security and data risk: leaked keys, open database rules, and secrets that shipped to the browser.

Supabase service role key exposed in frontend code

It bypasses every row-level security rule you have. How to confirm the exposure, rotate the key, and fix it for good.

learn · exposed

Anon key vs service role key: which is safe to expose

One is designed to be public, the other is a master key. How to tell them apart, where each belongs, and what the sb_publishable_ rename changes.

learn · key safety

Firestore rules: allow read, write: if true

This rule makes your entire database public, no login required. How it sneaks into production and how to replace it with real per-collection rules.

learn · exposed

Firebase apiKey in your frontend is fine (and what isn't)

The apiKey is public by design; Security Rules protect your data. The credentials that really are dangerous: the Admin SDK key and Gemini API keys in client code.

learn · key safety

New guides ship every week. Each one maps to a check the scanner actually runs.

Ascertify is a static code audit for AI-built and agency-delivered apps. It reads your code without running it and reports what's exposed, what's missing, and what to fix first, in plain English, pinned to the exact file and line. Every guide here maps to a check the scanner runs; the free preview tells you how many of these issues your code has.

Scan your code, free to start Read a sample report

Read-only access. Your code is sandboxed, never executed, and deleted after the scan.