Confirmed
Missing Content-Security-Policy header
The submitted page response did not include the header.
Security checks for AI-built web apps
Your app works.
Now check what it exposes.
Start with a free check of your live app and get evidence you can act on. When the public view cannot answer a server-side question, SafeForProd shows what source access or expert review would resolve it.
Free first look · No account · Evidence attached
NEEDS VERIFICATION F-002
High-risk credential pattern in public JavaScript
A value matching a privileged-key pattern appears in a referenced bundle. The free scan does not use the value or call the provider.
asset /assets/index-a82f.js
evidence provider-aware pattern match
next step verify role, rotate if privileged
Scope note: validity, database access, and RLS enforcement were not tested.
What the free scan can show
Evidence first. Uncertainty stays visible.
Result state is separate from severity and confidence. A serious-looking signal can still need authorized verification.
Read the methodologyNeeds verification
High-risk credential pattern in a public bundle
The pattern is visible; provider role and current validity still need verification.
Informational
Supabase project URL and public client key
These values are commonly publishable; security depends on server-side policy.
Not tested
Row Level Security enforcement
The free scan does not query tables or exercise user permissions.
Coverage grows with access
The free result leads somewhere useful.
The free scan earns attention with concrete public evidence. Each unknown then names the stronger source-backed or human check that could resolve it.
01
Free passive scan
Free entry point
A submitted live URL. No account.
What it covers: Public HTML, referenced JavaScript, source exposure, security headers, and browser-visible configuration.
Boundary: No login, private-route probing, API calls, data queries, RLS tests, authorization tests, or rate-limit tests.
02
Authorized source scan
Planned product
Account, ZIP or read-only GitHub, written authorization, and domain verification.
What it covers: Source, dependencies, configuration, auth and data-flow patterns, plus bounded runtime validation inside the approved scope.
Boundary: Not exhaustive and not a security certification. Nothing outside the verified target is tested.
03
Human security review
Scoped expert service
Agreed source/runtime access and a written scope.
What it covers: High-risk business logic, architecture, access control, and data paths, with a prioritized signed report.
Boundary: Coverage is limited to the signed scope; it is not unlimited penetration testing or a guarantee.
Safe by design
The free scan observes; it does not explore.
It fetches the submitted page and assets that page references. It does not guess admin paths, call discovered APIs, query databases, log in, introspect GraphQL, or test rate limits.
Every report records what was observed, how the evidence was classified, what was not tested, and what kind of access would be needed for a stronger conclusion.
Start with the free scan
See what your live app exposes.
Send the live URL you own or are authorized to assess. Start with the limited outside-in view; the report explains when planned source-backed validation or a scoped human review would add value.
No credit card. No signup. We only test what's publicly accessible.