EXAMPLE SECURITY REPORT

A clear path to a safer app.

A sample of the evidence and fixes your report will contain. These examples describe no actual target or scan.

Demo app: https://your-app.example

1EXAMPLE FINDING

1INFORMATIONAL EXAMPLE

0ACTUAL CHECKS RUN

This is not a security assessment of the entered app. There is no security score, and no claim that an app is safe. Real reports disclose incomplete coverage.

MEDIUM

Content Security Policy is missing

Example: a page response has no enforcing Content Security Policy. A policy can reduce the impact of injected scripts.

PASSIVE · EXAMPLE

Example evidence

SYNTHETIC EXAMPLE
GET / → 200
Content-Security-Policy: not present
No request was made to the entered domain.

Remediation guidance

Start with report-only in staging. Configure script nonces and your required origins before enforcing a policy.

TYPESCRIPT · ADAPT BEFORE DEPLOYING

// Merge into next.config.mjs. Review in staging first.
async headers() {
  return [{
    source: '/:path*',
    headers: [{
      key: 'Content-Security-Policy-Report-Only',
      value: "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'",
    }],
  }];
}

Official guidance ↗

INFO

Supabase public client key detected

Example: an anon or publishable key appears in client code. These keys are designed for browser use and are not vulnerabilities on their own.

PASSIVE · EXAMPLE

Example evidence

SYNTHETIC EXAMPLE
Key category: publishable / anon
Value: [EXAMPLE ONLY — NO KEY COLLECTED]

Remediation guidance

No key rotation is suggested for a normal public key. Review grants and Row Level Security. Exposed service-role or secret credentials would instead be critical.

Official guidance ↗

What a real scan checks

Security headersNot run
Client-side credentialsNot run
Deployment files & source mapsNot run
Supabase project detectionNot run
Supabase configurationNot run

← Scan progress Pre-order for $49