Security checks
Every check
RepoFort runs.
RepoFort currently runs 57 security checks across your GitHub repository and deployed site — covering secrets, authentication, injection attacks, HTTP headers, and more.
Secrets & CredentialsAuthenticationAuthorizationAPI SecurityFrontend SecurityDatabase AccessConfigurationHTTP Security Headers
Scan typeRepo scan— static analysis of your source codeLive site— passive HTTP header analysis of your deployed URLLive probe— active probing of your Supabase project (opt-in)
Secrets & Credentials
Credentials and sensitive values committed to code or exposed to the browser.
Critical
Hardcoded API Keys & Secrets
Detects credentials for Stripe, OpenAI, AWS, GitHub, SendGrid, Twilio, Resend, and other services committed directly in source code instead of stored in environment variables.
Repo scan
Critical
Supabase Service Role Key Exposure
Identifies the Supabase service role key—which bypasses Row Level Security entirely—being used outside of strictly server-only files.
Repo scan
Critical
Exposed Secret in Client-Side Bundle
Scans the code that ships to the browser for exposed provider keys (OpenAI, AWS, Stripe) and other hardcoded secrets, using entropy scoring and context analysis to filter out placeholders and test values. OpenAI keys are additionally confirmed with a read-only API check before a finding is escalated to critical.
Repo scan
Critical
/.env File Exposed
Live site check: attempts to fetch a /.env file from your deployed site and flags it when environment secrets are being served publicly.
Live site
Critical
/.git Directory Exposed
Live site check: checks whether your /.git directory is publicly downloadable, which would let anyone reconstruct your entire source history.
Live site
High
.env File Committed to Repository
Flags environment files (.env, .env.local, .env.production, etc.) containing key=value pairs that have been checked into version control.
Repo scan
High
Secret Exposed via NEXT_PUBLIC_ Variable
Catches sensitive credentials in environment variables prefixed with NEXT_PUBLIC_, which Next.js bundles into the client-side JavaScript and makes readable by every site visitor.
Repo scan
Medium
Sensitive Data Logged to Console
Finds console.log calls in server-side code that may print passwords, API keys, or tokens to production log streams accessible via log aggregation platforms.
Repo scan
Medium
Sensitive Data Passed to Logger
Detects structured logger calls that may serialize passwords, tokens, or authorization headers, and request body serialization that can capture credentials in log platforms.
Repo scan
Low
Firebase Client Configuration Exposed
Flags a Firebase web configuration shipped in the client bundle. The config is public by design, so this is surfaced as a low-severity reminder to verify your Firebase Security Rules are not left in permissive test mode.
Repo scan
Authentication
Session verification, access guards, and identity checks on protected routes.
Critical
Supabase Row Level Security Disabled
Detects database tables where RLS is explicitly disabled, uses an always-true policy, or is never enabled in a migration file — leaving all rows accessible to any authenticated user.
Repo scan
Critical
Stripe Webhook Missing Signature Verification
Flags Stripe webhook handlers that process payment events without verifying the Stripe-Signature header, making the endpoint accept any forged event.
Repo scan
Critical
Database Seed Route Left in Production
Live site check: probes for a database seed endpoint left in production that could repopulate or wipe your data with a single request.
Live site
Critical
Database Reset Route Left in Production
Live site check: probes for a database reset endpoint left in production that could wipe all application data.
Live site
Critical
Database Migration Route Left in Production
Live site check: probes for a publicly reachable database migration endpoint that could alter your schema on demand.
Live site
Critical
Database Nuke Route Left in Production
Live site check: probes for a destructive endpoint that could delete all database content in a single request.
Live site
High
Server Action Without Authentication
Identifies Next.js Server Actions ("use server" files) that write to the database without first verifying the caller's identity—these are callable from the browser by any user.
Repo scan
High
Weak JWT Secret
Identifies JWT signing or verification calls using short, guessable strings instead of a cryptographically random secret, enabling token forgery by brute-force.
Repo scan
High
Missing Ownership Check (IDOR)
Flags dynamic API routes that query or modify database records by URL-supplied ID without confirming the record belongs to the requesting user—a classic IDOR vulnerability.
Repo scan
High
Public /admin Route
Live site check: requests the /admin path on your deployed site and flags it when an administrative interface responds without requiring authentication.
Live site
High
Public /debug Route
Live site check: looks for a reachable /debug endpoint on your deployed site that could expose internal state or trigger development-only behavior.
Live site
High
Application Setup Route Left in Production
Live site check: probes for a first-run setup endpoint left in production that could re-initialize the app or create a new admin account.
Live site
High
Database Studio Interface Publicly Exposed
Live site check: detects a publicly deployed database management UI (such as Supabase Studio) that would grant point-and-click access to all your data.
Live site
High
Admin API Endpoint Publicly Reachable
Live site check: probes for an /api/admin endpoint that responds to privileged operations without authentication.
Live site
Medium
Missing Authentication on Sensitive Route
Checks API routes for billing, admin, account, and payment operations for the presence of a session or user verification call before handling the request.
Repo scan
API Security
CORS policy, CSRF protection, and rate limiting on API endpoints.
High
CSRF Protection Missing
Detects Express route handlers that define mutating endpoints (POST, PUT, DELETE, PATCH) without CSRF token middleware, allowing malicious sites to trigger authenticated requests.
Repo scan
High
Permissive CORS Configuration
Detects wildcard Access-Control-Allow-Origin: * settings in API routes and middleware that allow any origin to read cross-origin API responses.
Repo scan
High
Wildcard CORS Header on Live Site
Live site check: flags a wildcard CORS policy returned in the HTTP response headers of the deployed application.
Live site
Medium
Missing Rate Limiting on Auth Endpoint
Identifies login, signup, and password reset routes that have no request throttling configured, leaving them open to brute-force and credential-stuffing attacks.
Repo scan
Medium
API Documentation Publicly Exposed
Live site check: detects publicly reachable API documentation (Swagger/OpenAPI) that maps your entire endpoint surface for anyone to read.
Live site
Medium
GraphQL Endpoint Publicly Reachable
Live site check: detects a publicly reachable GraphQL endpoint that may allow schema introspection without authentication.
Live site
Frontend Security
Client-side injection risks including XSS and dynamic code execution.
High
Dynamic Code Execution (eval)
Flags use of eval() and new Function() which execute arbitrary JavaScript strings at runtime — especially dangerous when the input originates from user data.
Repo scan
High
XSS: Dangerous HTML Injection
Detects patterns that insert unescaped HTML into the DOM — including dangerouslySetInnerHTML, innerHTML assignments, document.write, and API responses that echo back request data directly.
Repo scan
Database Access
SQL injection and unsafe raw query patterns that bypass parameterization.
Critical
SQL Injection via Raw Query
Flags raw SQL queries assembled with template literals or string concatenation instead of parameterized queries — the most common path to SQL injection.
Repo scan
High
Unsafe Prisma Raw Query
Detects Prisma's unsafe raw query methods that accept a plain SQL string without automatic parameterization, creating SQL injection risk when user input is involved.
Repo scan
Configuration
Cookie flags, error handling, command injection, and other server hardening issues.
Critical
Command Injection
Detects shell execution calls that interpolate user-supplied values into the command string, allowing an attacker to append shell operators and run arbitrary server commands.
Repo scan
High
Path Traversal
Identifies file system operations that construct paths from request parameters without validation, enabling directory traversal to read or overwrite arbitrary server files.
Repo scan
High
Prototype Pollution
Flags deep merge or Object.assign operations with user-supplied request data that can corrupt Object.prototype and silently inject properties across the entire application.
Repo scan
Medium
Insecure Cookie Configuration
Finds cookie configurations in application code that explicitly disable Secure, HttpOnly, or set unsafe SameSite values, weakening session protection.
Repo scan
Medium
Cookies Set Without Secure Flag
Live site check: session cookies missing the Secure attribute can be transmitted over plain HTTP connections, exposing them to network interception.
Live site
Medium
Cookies Set Without HttpOnly Flag
Live site check: cookies missing HttpOnly are readable by JavaScript, making them vulnerable to theft via any XSS vulnerability on the site.
Live site
Medium
Internal Error Details Exposed to Client
Detects API routes that return raw error messages or stack traces in HTTP responses, exposing database schema, file paths, and library versions to potential attackers.
Repo scan
Medium
HTTP Not Redirected to HTTPS
Live site check: confirms that visiting your site over plain HTTP is redirected to HTTPS rather than being served over an unencrypted connection.
Live site
Low
Cookies Set Without SameSite Attribute
Live site check: cookies without a SameSite attribute are included on cross-site requests by default, enabling CSRF attacks against authenticated sessions.
Live site
Low
robots.txt Discloses Hidden Paths
Live site check: reviews robots.txt for sensitive paths that were disallowed, since listing them there advertises their existence.
Live site
Low
Server Version Disclosed
Live site check: the Server response header includes version information that lets attackers quickly identify which CVEs apply to this server without further probing.
Live site
Low
X-Powered-By Header Present
Live site check: the X-Powered-By response header reveals the server-side framework and potentially its version, aiding targeted exploit selection.
Live site
Low
Health Endpoint May Expose Internal Details
Live site check: requests a /api/health endpoint and flags it when the response may expose internal configuration or service details.
Live site
HTTP Security Headers
Browser security directives including CSP, HSTS, and clickjacking protection.
High
Missing Content-Security-Policy Header
Live site check: absence of a CSP header leaves browsers unrestricted on which scripts and resources can execute, reducing defense-in-depth against XSS.
Live site
Medium
Missing Strict-Transport-Security (HSTS)
Live site check: without HSTS, browsers may connect over HTTP, exposing users to SSL stripping and protocol downgrade attacks on untrusted networks.
Live site
Medium
Missing X-Frame-Options Header
Live site check: without X-Frame-Options or a CSP frame-ancestors directive, the page can be embedded in iframes on malicious sites for clickjacking attacks.
Live site
Low
Security Headers Not Configured
Flags Next.js config files that lack a headers() function, meaning CSP, HSTS, X-Frame-Options, and other security headers are not sent by the application.
Repo scan
Low
Missing X-Content-Type-Options Header
Live site check: without the nosniff directive, some browsers may MIME-sniff responses and execute files as a different content type than intended.
Live site
Low
Missing Referrer-Policy Header
Live site check: without a Referrer-Policy, sensitive URL paths or query parameters may leak to third-party services via the browser's Referer header.
Live site
Low
Missing Permissions-Policy Header
Live site check: without a Permissions-Policy, powerful browser APIs such as camera, microphone, and geolocation are not restricted at the HTTP layer.
Live site
How this page stays current
This page is generated at build time from
lib/security/security-catalog.ts, the single source of truth that mirrors the live scanner rule files. The dashboard Security Guide is generated from the exact same catalog, so both surfaces always show the same set of checks and the same count. Adding one entry there updates this page, the guide, and every count automatically on the next deploy. Detection patterns and payloads are deliberately not published here.Run all 57 checks against your repo.
Free tier · No install required · Results in under 60 seconds.