This is auditbuffet.com’s Stack Scan from May. We failed 2 of our own critical security checks at 93/A, fixed them, and re-ran it to 100/A two days later.
93/A
2026-05-27
100/A
2026-05-29
22 passed · 2 failed · 1 not applicable
Our analytics table had a write-anything policy with nothing in the code saying why. It was intentional (anonymous page-view telemetry has to accept inserts), but the audit wants that reason written down where the next person will read it.
Fixed: Added the waiver comment explaining why the policy is public, right above the policy.
6 public catalog endpoints had no auth and no marker saying that was on purpose. They serve openly-licensed catalog data by design, but an unmarked public route looks exactly like a forgotten one.
Fixed: Marked each route // PUBLIC with the reason and its rate limit.
From the raw telemetry in our repo (docs/self-audits/).
This is what a scored project looks like on AuditBuffet.
Illustrative example — “Acme SaaS” is a fictional project with sample data.
82
Overall Health Score
19/20 checks passed
17/20 checks passed
14/18 checks passed
15/21 checks passed
14/16 checks passed
Run your first Stack Scan to detect your tech stack and get personalized audit recommendations.
Run Your First Stack Scan