Report ready
Base security modules
Verified URL evidence is available now.
Representative walkthrough · not a live scan
Evidence, fix prompts, and retest workflow in one report.
Follow a report from the first verified evidence through independent deep scanners, AI-assisted remediation, re-testing, and continuous monitoring. Every value on this page is labelled as representative—not customer telemetry.
app.example.com
Security scan · representative
- Base report ready for review
- Independent deep engines continue
- Score confidence follows verified coverage
Progressive delivery
Useful evidence now. Deeper coverage without blocking the report.
Base modules publish their verified observations first. After owner verification, deeper checks for Injection, XSS, Ports, known exposures, web application behavior, and deployed code keep their own state and join the same report only when their results are ready. Pending and unavailable never mean passed.
Running independently
Injection · XSS · Ports
The three in-process heavy scanners settle separately after owner verification.
Running
Known Exposure Checks
Template-backed checks continue independently.
Queued
Web Application Behavior
The base report does not wait for this engine.
Unavailable in this sample
Deployed Code Review
No verified deployed-code result was produced, so no clean pass is inferred.
What the reader can trust: Only completed, verified scanner output can become a confirmed finding or a clean pass. The report refreshes as independent engines finish. It never invents a result to fill a gap.
Findings
Evidence is the source of truth. Interpretation stays labelled.
Representative walkthrough · not a live scan Follow a report from the first verified evidence through independent deep scanners, AI-assisted remediation, re-testing, and continuous monitoring. Every value on this page is labelled as representative—not customer telemetry.
CriticalRepresentative walkthrough · not a live scansupabase:supabase-service-role-exposed
Supabase service-role key exposed in client bundle
- Observed by scanner
- A browser-delivered JavaScript asset contains a Supabase service-role token fingerprint. The secret value is redacted from the report.
- AI interpretation
- Treat the token as compromised: rotate it, move privileged calls server-side, and review Supabase audit activity. This guidance does not replace the scanner evidence above.
MediumRepresentative walkthrough · not a live scanheaders:csp
Content Security Policy is missing
- Observed by scanner
- The final HTML response did not include a Content-Security-Policy or Content-Security-Policy-Report-Only header. Response details are retained as evidence.
- AI interpretation
- Start in report-only mode, review violations, then enforce a policy scoped to the application's actual script and connection origins.
Passed checks
- TLS certificate is valid and not near expiry.
- DMARC policy is present for the primary domain.
- No public .env file detected on common exposure paths.
- No malware or defacement signal in the latest monitor check.
Score transparency
This walkthrough does not publish a made-up final score. A real report keeps the overall score and grade unavailable until all required categories, including the six verified-owner heavy scanners, settle with fully verified coverage. Pending, partial, and unavailable scanners remain visible and never produce a numeric provisional score.
Base coverage
Completed
Deep coverage
Still in progress
Unavailable
Never counted as passed
AI fix prompt
Remove the exposed Supabase service-role credential. Rotate and revoke the compromised key before deployment. Move privileged operations into a server-only module. Keep only the anon key in browser-delivered code. Add a build test that rejects service-role fingerprints.
Generated from the verified finding context. Secrets and sensitive evidence stay redacted from the prompt.
Compliance mapping
References help route remediation work. They do not claim certification or legal compliance.
OWASP A01: Broken Access ControlOWASP A05: Security MisconfigurationCWE-798: Use of Hard-coded CredentialsCWE-693: Protection Mechanism Failure
Care monitoring
Make this report the baseline, not the finish line.
Care watches uptime, SSL, DNS, blocklists, client-side threats, defacement, and recurring deep scan results. It records verified changes and keeps incomplete scanners visible instead of turning them into false reassurance.
Honest score and finding history
No past runs are fabricated for this sample. History begins after ownership verification and Care activation.
- Baseline
Current verified report
Captured after activation
- Weekly
Compare deep results
New, resolved, and changed
- On change
Alert, fix, re-test
Only verified regressions
Email owner
Slack team
Signed webhook
What you get
See before you buy
Every scan starts with a free preview of available finding names, category counts, severity counts, and coverage. The score and grade stay unavailable until owner verification and all 6 heavy scanners settle. Pay only for the full breakdown and fixes.
Full descriptions for every finding
Step-by-step fix instructions
AI prompts for Cursor / Lovable / Claude / Bolt
Downloadable PDF + email delivery