Back to the examples

Example report

Free security check.

This is the output of the free security skill on the same app. It runs six quick checks and says plainly what it cannot judge. Compare it with the full security report to see what the paid version adds.

Example output from the free skill, run on the same app as the paid reports. Names and identifiers have been changed.

I ran the scanner on the repository. It made six checks and found no leaked secrets, but it flagged one critical and 11 high-severity vulnerable dependencies. I changed no files, and I read the code at each flagged spot.

What was checked: secrets in code, environment files, secrets exposed to the browser, endpoints with no sign of authentication, known vulnerable dependencies, and wide-open database rules.

Real finding: vulnerable dependencies

npm audit reports 1 critical and 11 high issues in production dependencies. Four are packages you depend on directly:

  • next is the critical one. The affected range runs up to 16.4.0, so update it first.
  • hono is high. It has HTML-injection bugs in hono/jsx. They only matter if you use that feature. A moderate bug in @hono/node-server (static-path middleware bypass) is also listed.
  • ws is high.
  • Transitive (pulled in by other packages) and high: @grpc/grpc-js (malformed requests can crash it), brace-expansion, fast-xml-builder, form-data, nanoid, postcss, protobufjs, sharp and source-map-js. Most of these are denial-of-service or injection bugs that need specific conditions to be reachable.

The first step is to run npm audit fix, since npm reports a fix for the ones I checked. Then re-run npm audit --omit=dev and test the app. Upgrading next across versions may need code changes. I can't tell from here which of these are reachable in how you use them.

False alarm: api/src/routes/health.ts

The scanner flagged this endpoint for having no authentication. It's a Cloud Run and uptime health check that returns only a static status, the service name and a timestamp. It should be public, and it leaks nothing.

Clean

No hardcoded secrets, no committed environment files, nothing sensitive exposed to the browser, and no wide-open database rules were reported.

Limits of this check

It ran 6 automated checks. It can't tell you whether your login is built safely, whether one user can read another user's data, whether your payment webhooks can be faked, or whether your database rules are right. The scanner found 65 endpoint files, and only the health route was flagged. It didn't judge whether authorization on the other 64 is correct.

The full Security Audit skill runs about 30 automated checks plus a manual checklist. It verifies each finding by reading your code, covers Next.js, Supabase, Stripe and cloud setups, scores findings consistently, and writes a report with a fix prompt for every issue.

Want this for your project?

See pricing