Checks

The free scan runs these against the public site. Repo and two-account checks come later.

• service_role key in the browser

  A JWT in the client bundle whose role claim is service_role, or a value labelled SUPABASE_SERVICE_ROLE. We show an 8-character prefix and a hash, not the key.

• Stripe secret key in the browser

  Strings matching sk_live_, sk_test_, rk_live_, or rk_test_. Publishable pk_ keys are not flagged.

• Anon key in the client

  A Supabase JWT with role anon. This is informational. The anon key is public by design.

• Exposed env file

  A request to /.env, /.env.local, or /.env.production returned 200 and KEY=value lines, and the body was not an HTML app shell.

• Exposed Git metadata

  /.git/HEAD returned a refs/heads line, or /.git/config looked like a git config.

• Production source map

  A .js.map response includes sources under src/, .env, server, or supabase paths. We do not store sourcesContent.

• Security headers

  We look for Content-Security-Policy, HSTS with max-age of at least 180 days, framing protection, Referrer-Policy, and Permissions-Policy.

• Default framework title

  The document title is still "Vite App", "Create Next App", "React App", or another framework default.