Stack Scan

project-snapshot · v2.0.1 · free

Mile-wide, inch-deep survey of any AI-built project: 35 surface-level checks across 10 categories — secrets, auth, injection, data exposure, legal, accessibility, SEO, performance, error handling, and code quality.

Exposed Secrets

secrets · weight 0.13

.env files are gitignored
ab-002565
critical
No API keys or secrets hardcoded in source
ab-002566
critical
Only PUBLIC_-prefixed env vars referenced from client code
ab-002567
high
No service-role/secret keys exposed via PUBLIC_ prefix
ab-002568
high

Auth & Access

auth-access · weight 0.13

Supabase Row-Level Security is not disabled
ab-002569
critical
Session cookies use httpOnly + Secure + SameSite
ab-002570
critical
Protected routes have auth guards
ab-002571
critical
No NODE_ENV-based auth bypass
ab-002572
medium

Injection & XSS

injection · weight 0.1

No dangerouslySetInnerHTML with user input
ab-002573
high
User input is validated before use
ab-002574
high
No SQL string concatenation
ab-002575
high
CORS is not wildcard in production
ab-002576
medium

Data Exposure

data-exposure · weight 0.1

API routes have authentication
ab-002577
high
No PII files in client bundle / public directory
ab-002578
critical
No source maps served in production
ab-002579
low
Production error pages don't leak stack traces
ab-002580
info

Legal Liability

legal · weight 0.1

Cookie consent banner present when tracking is in use
ab-002581
medium
Privacy policy page exists and is linked
ab-002582
medium
security.txt present at /.well-known/security.txt
ab-002583
low

Accessibility

accessibility · weight 0.1

Images have alt text
ab-002584
high
Form inputs have labels
ab-002585
medium
Skip-to-content link present
ab-002586
low

SEO Basics

seo · weight 0.09

Title tags are present and non-default
ab-002587
medium
Meta descriptions are present
ab-002588
medium
sitemap.xml is generated
ab-002589
low
robots.txt is present
ab-002590
low

Performance

performance · weight 0.09

No render-blocking third-party scripts
ab-002591
high
Static assets are compressed (build config enables it)
ab-002592
medium
Images have explicit dimensions
ab-002593
low

Error Handling

error-handling · weight 0.08

No error swallowing
ab-002594
high
Has error boundary at root layout
ab-002595
high
API errors return structured JSON
ab-002596
medium

Code Quality Smells

code-quality · weight 0.08

No TODO/FIXME/HACK blocking comments in production code
ab-002597
high
No console.log statements in production source
ab-002598
medium
README.md exists with project description
ab-002599
info