This is an example of what you get. The app, keys and numbers below are made up (demo data). It shows the Full Scan view; the free preview shows only your score, the counts and the title of your top problem.
12out of 100
2 critical1 medium8 passed
Not Greenlit yetFix the critical and medium findings, re-scan, and this turns into a Greenlit badge you can put on your site.
Findings
critical
Your Supabase admin key is public
A key that can read, change and delete every row in your database is inside a JavaScript file that every visitor downloads. Anyone who opens their browser tools can copy it.
Where:/assets/index-4f2a9c.js
Evidence:JWT with role=service_role: eyJhbG…x9Qw (219 chars)
Fix prompt(paste into Lovable, Cursor, Bolt, Replit, v0, Windsurf or Claude Code)
My app exposes a Supabase service_role key in client-side code (found in /assets/index-4f2a9c.js). Find every place the service_role key or SUPABASE_SERVICE_ROLE_KEY is used, move that code into a server-only function (API route or Edge Function), and make the browser use only the anon/publishable key. List every file you changed. Then tell me to rotate the service_role key in Supabase (Project Settings, API) because the old one must be treated as stolen.
critical
Anyone can read your “profiles” table
The public key in your app can read every row of the profiles table. Row Level Security is switched off, so your users’ names and emails are open to anyone who asks.
Evidence:HTTP 200, 1,284 rows visible to the anon key (count only, rows not downloaded)
Fix prompt(paste into Lovable, Cursor, Bolt, Replit, v0, Windsurf or Claude Code)
My Supabase table public.profiles has Row Level Security disabled, so the anon key can read all rows. Write a SQL migration that enables RLS on public.profiles and adds policies so a signed-in user can select and update only their own row (auth.uid() = id). Check every other table in the public schema for the same problem and include them. Do not drop any data.
medium
Outdated jQuery 3.4.1 with known vulnerabilities
Your site loads an old copy of jQuery that has publicly known security flaws. Attackers know how to abuse them, and the fix is just a newer version.
Where:/assets/vendor-91c3.js
Evidence:jQuery 3.4.1 detected in /assets/vendor-91c3.js; fixed in 3.5.0+. CVE-2020-11022 / CVE-2020-11023 (XSS in htmlPrefilter)
Fix prompt(paste into Lovable, Cursor, Bolt, Replit, v0, Windsurf or Claude Code)
My app bundles jQuery 3.4.1 (found in /assets/vendor-91c3.js), which has known XSS vulnerabilities (CVE-2020-11022 / CVE-2020-11023). Upgrade jQuery to 3.5.0 or later in package.json, reinstall, rebuild, and check every page that uses it still works. List every file you changed.