Keys and settings
- No secret keys in the website. Payment, AI, email and database admin keys live only in your host’s server settings.
- No setting with a public prefix (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_) holds anything secret.
- Your .env file isn’t downloadable from your live site (yoursite.com/.env should not show it).
Who can see and change data
- Every database table with user data has access rules. On Supabase that means row level security on, with policies.
- Logged in as one user, you can’t open another user’s records by changing an ID in the address.
- Anything a free user can’t see in the interface also refuses them on the server, not just hidden.
- Admin pages check that the person is an admin on the server, every time.
Logins and payments
- Password reset and sign-in links expire and work once.
- Payments are confirmed by the payment provider’s webhook, with its signature checked, not by the page saying “success”.
- Prices are set on the server, so nobody can change the amount in their browser.
A way back
- You know how to roll back to the last working version (your builder’s history, or Git).
- Your data is backed up, and you know where the backup is.
What a free scan covers, and what it can’t
A scan of your live site can check the first group (keys, public files) and your browser protections automatically. The middle groups depend on how your app works inside, so they need either careful testing as two users, or an engineer reading the code.