Stack Scan

project-snapshot · v3.1.1 · free

Consequence-first scan of your AI-built project: 25 checks that catch the scariest things AI coding tools ship wrong — broken access control (IDOR), unenforced validation, missing security headers, no account deletion, no payment-amount validation. Enough signal to know which Pro audits to run next.

Security Problems

security · weight 0.45

.env files are gitignored
ab-002565
critical
No hardcoded API keys or secrets in source
ab-002566
critical
No service-role or secret keys exposed to the public bundle
ab-002568
critical
Supabase RLS is enabled with real policies on every table
ab-002569
critical
API routes require authentication
ab-002577
critical
Protected route groups actually call a session getter
ab-002611
critical
Dynamic-id routes enforce object-level ownership
ab-002612
critical
Validation schemas are actually parsed at runtime
ab-002613
critical
Imported security middleware is actually wired in
ab-002614
high
Core security response headers are configured
ab-002615
high
User content does not reach dangerous sinks unsanitized
ab-002616
critical

Legal Exposure

legal · weight 0.35

Tracking scripts gated on consent
ab-002581
high
Images have alt text
ab-002584
critical
Form inputs have labels
ab-002585
high
Users can delete their account and PII is actually purged
ab-002617
critical
Users can download a machine-readable export of their personal data
ab-002618
high
Footer exposes a "Do Not Sell or Share" / "Your Privacy Choices" opt-out link
ab-002619
high
Server-side code does not log full user objects, bodies, or credentials
ab-002620
high
Terms of Service and Privacy Policy pages exist and are linked from the footer
ab-002621
medium

Abuse Surface

abuse · weight 0.2

Webhook endpoints verify the incoming signature
ab-002601
high
Login / signup / password-reset endpoints have rate limits
ab-002604
high
Webhook handlers are idempotent
ab-002609
medium
List-returning API endpoints enforce pagination or hard limits
ab-002610
medium
Payment amounts sourced server-side, never from client
ab-002622
critical
No PII, card data, or session tokens in server logs
ab-002623
high