Stack Scan (project-snapshot)

project-snapshot · tx-project-snapshot

Synthetic taxon carrying the 35 patterns extracted from the Stack Scan free-tier audit (project-snapshot).

This taxon exists because the Stack Scan free-tier audit covers ten distinct domains (secrets, auth, injection, data exposure, legal, accessibility, SEO, performance, error handling, code quality) at shallow depth. Each of the 35 patterns is load-bearing only inside the Stack Scan composite — they are mile-wide/inch-deep by design, and each category maps to a dedicated Pro audit that covers the domain in depth.

Patterns in this taxon are NOT intended to be imported into other bundles. The deep coverage lives in the matching Pro audit (security-hardening, saas-authentication, etc.).

Patterns in this taxon (25)

.env files are gitignored
ab-002565 · project-snapshot
critical
API routes require authentication
ab-002577 · project-snapshot
critical
Core security response headers are configured
ab-002615 · project-snapshot
high
Dynamic-id routes enforce object-level ownership
ab-002612 · project-snapshot
critical
Footer exposes a "Do Not Sell or Share" / "Your Privacy Choices" opt-out link
ab-002619 · project-snapshot
high
Form inputs have labels
ab-002585 · project-snapshot
high
Images have alt text
ab-002584 · project-snapshot
critical
Imported security middleware is actually wired in
ab-002614 · project-snapshot
high
List-returning API endpoints enforce pagination or hard limits
ab-002610 · project-snapshot
medium
Login / signup / password-reset endpoints have rate limits
ab-002604 · project-snapshot
high
No hardcoded API keys or secrets in source
ab-002566 · project-snapshot
critical
No PII, card data, or session tokens in server logs
ab-002623 · project-snapshot
high
No service-role or secret keys exposed to the public bundle
ab-002568 · project-snapshot
critical
Payment amounts sourced server-side, never from client
ab-002622 · project-snapshot
critical
Protected route groups actually call a session getter
ab-002611 · project-snapshot
critical
Server-side code does not log full user objects, bodies, or credentials
ab-002620 · project-snapshot
high
Supabase RLS is enabled with real policies on every table
ab-002569 · project-snapshot
critical
Terms of Service and Privacy Policy pages exist and are linked from the footer
ab-002621 · project-snapshot
medium
Tracking scripts gated on consent
ab-002581 · project-snapshot
high
User content does not reach dangerous sinks unsanitized
ab-002616 · project-snapshot
critical
Users can delete their account and PII is actually purged
ab-002617 · project-snapshot
critical
Users can download a machine-readable export of their personal data
ab-002618 · project-snapshot
high
Validation schemas are actually parsed at runtime
ab-002613 · project-snapshot
critical
Webhook endpoints verify the incoming signature
ab-002601 · project-snapshot
high
Webhook handlers are idempotent
ab-002609 · project-snapshot
medium