A report should show what the evidence proves—and what it does not.

Evidence

The HTML response for https://example.app/ did not include a Content-Security-Policy or Content-Security-Policy-Report-Only header.

Impact

CSP can limit the impact of some script-injection paths. Its absence is a hardening gap, not proof that script injection is possible.

Remediation

Define a policy from the resources the app actually needs. Start in report-only mode, review violations, then enforce the smallest workable allowlist.

Scope and limitation

Confirmed from the submitted page response. Other routes were not requested.

Retest: Not retested

Evidence

A referenced bundle contained a provider-specific value that matches the format of a privileged server credential. The value is redacted in the report.

Impact

If the value is current and privileged, a visitor could copy it. The free scan does not use the value, call the provider, or infer access from format alone.

Remediation

Verify the credential role in the provider dashboard. If it is privileged, revoke and rotate it, move the replacement server-side, and rebuild the public assets.

Scope and limitation

Pattern and public location observed. Role, validity, permissions, and reachable data were not tested.

Retest: Requires owner verification

Evidence

The client initialization includes the project URL and an anon/publishable key, as expected for browser-side Supabase clients.

Impact

Visibility alone is not a secret leak. The security boundary is enforced by Row Level Security, grants, and server-side handling of privileged keys.

Remediation

Do not rotate a publishable key merely because it is public. Review RLS and grants through the planned Authorized source scan, or an equivalent owner-run review, if you need assurance about data access.

Scope and limitation

Key class identified from public configuration. No table, policy, or data request was tested.

Retest: No public-surface fix required

Evidence

No database table was queried and no authenticated role was exercised.

Impact

The public-surface report cannot conclude that RLS is correct, missing, or bypassable.

Remediation

Review policies, grants, ownership checks, and approved role behavior through the planned Authorized source scan, an equivalent owner-run review, or a Human security review.

Scope and limitation

Outside the free scan’s public-surface scope.

Retest: Needs authorized scope