Sample report
A redacted example of the report for a fictional app. The format, depth and severity language are the ones you receive; the app, people and values are made up.
SAMPLE. Ledgerly is a fictional app. Hostnames, ids and keys below are invented and redacted to show format only.
Scope and method
Ledgerly is invoicing for freelancers: a Next.js frontend on Vercel, Supabase for auth, database and storage, and two edge functions.
Scope
public schema, 2 storage buckets, 2 edge functionsMethod
Summary
Severity follows one scale: Critical, High, Medium, Low. Status is Fixed once we have retested the change, or Open with a date.
| Severity | What it means | Found | Fixed |
|---|---|---|---|
| Critical | Another user's data can be read or changed with no special access. | 1 | 1 |
| High | A signed-in user can reach data or actions beyond their own. | 2 | 2 |
| Medium | Makes another problem easier, or exposes data with limited impact. | 2 | 2 |
| Low | Hardening that reduces risk; no direct path to data. | 1 | 0 |
| Fixed | Change made by the owner and retested by us. | 5 of 6 | |
Findings
Evidence. With only the public anon key and no sign-in, GET /rest/v1/invoices?select=id,client_name,total returned 214 rows across 31 accounts (response kept, ids redacted). Fix. Enabled RLS on invoices; added select, insert, update and delete policies comparing user_id to auth.uid(). Retest. Anonymous request returns []; user A sees only A's 6 invoices.
Evidence. Signed in as test user A, PATCH /rest/v1/profiles?id=eq.<A> with {"role":"admin"} returned the row with the new role, and the admin dashboard loaded for A. Fix. Moved roles to a user_roles table with no user write policy; revoked column update on profiles.role. Retest. Same request returns 403; A's role unchanged.
Evidence. Calling /functions/v1/send-invoice with A's token and B's user_id in the body emailed one of B's invoices to an address A chose. The function uses the service role key, so RLS does not apply inside it. Fix. The function now reads the user from the verified token and ignores user_id in the body. Retest. Request for B's invoice with A's token returns 404.
Evidence. The receipts bucket is marked public. A receipt URL copied from A's account opened in a signed-out private window. File names follow a guessable pattern (date plus invoice number). Fix. Bucket set to private, storage policies limit each user to their own folder, receipts served through 60-second signed URLs. Retest. The old URL returns 400; signed URLs expire as set.
Evidence. /_next/static/chunks/app-3f…a1.js.map answered 200 with the original source, including internal route names and comments. No secrets were in it; the anon key it contains is meant to be public. Fix. productionBrowserSourceMaps turned off in next.config.js; maps now upload privately to the error tracker. Retest. Map URLs return 404.
Evidence. The root document sends Strict-Transport-Security: max-age=86400 and no Content-Security-Policy. Fix. Paste-ready vercel.json headers block supplied, with a CSP that allows Supabase and Stripe. The owner is running it in report-only mode first. Retest. Scheduled after the next release.
Limits
Readout
We walk through each finding, in order of severity, on a 20-minute call with whoever will make the fixes. You get the SQL and config as text you can paste, and the report records the retest status of each fix.
This report describes the app at one point in time. It is not a guarantee that no other issues exist.
Ship Safe Check
Book the Ship Safe Check, $290. Includes database rules and auth review. Start with the free check if you'd like to see the browser view first.