Static analysis · no code executed
Your scan report
We found 3 critical issues, plus 2 items worth raising with your developer.
Static review only — we didn't run the app or test live behavior. See exactly what we checked and what we didn't ↓
Critical
These are specific, verifiable, and hard to argue with. Resolve them before you sign off on this build.
Your secret database admin key is sitting in code that ships to the browser. It bypasses every access rule you have. Anyone who opens your site can read or change all of your data.
Row-level security is switched off on the users table. Any signed-in visitor can read every row — names, emails, everything — not just their own record. The app works fine in testing because you're the only user.
A live OpenAI API key is committed to the repository. Anyone with access to the code — or its git history — can copy it and run up your bill.
Needs attention
Not emergencies, but real. These shape what it will cost you to keep, replace, or hand off this codebase.
Notes & signals
Softer signals. We report what we observed, not what it means — read these as questions to ask, not conclusions to draw.
Passed
Checks we ran that came back clean. We show these so you know what the result above does and doesn't cover.
What we checked, and what we didn't
We checked
- Hardcoded secrets and API keys
- SQL injection patterns
- eval() usage
- Unfiltered Supabase queries
- Test presence and coverage ratio
- README present
- npm scripts complete (dev, build)
- Lockfile committed
- .env.example present
- Circular dependencies
- Code complexity hotspots
- Code duplication
- Unused or dead dependencies
- Undeclared dependencies (imported but missing from package.json)
- Boilerplate ratio
- Firebase rules publicly open
- Row-level security disabled
- Supabase service-role key in frontend code
- Database migrations present
- Unsafe migrations
- Dangerous cascade deletes
- Missing foreign-key indexes
- Boilerplate-only schema
- Known CVEs in direct dependencies
- Deprecated or abandoned dependencies
- Undeclared imports verified against the npm registry
We did not check
- Commit count and delivery pattern
- All commits in 24 hours
- Single-author history
- We did not run your application or execute its tests
- Whether your features actually work as intended
- Runtime login/permission behavior
- Performance, scale, or hosting configuration
- Business-logic correctness
- Anything that requires a live, running system
This is a static review, not a penetration test. A clean result here is not a guarantee that your application is secure — it means the specific things we checked, listed above, came back clean. We report only what we can point to in your code.