Loading the live canvas…

This is a sample project. Map your own app in 2 minutes, free, no card.

Not ship-ready2 blockers (critical/high)

CriticalThe service-role key is in the browser bundle

security · Admin page

The admin page uses the Supabase service-role key so it can manage users. Any variable in a Vite build is inlined into the JavaScript everyone downloads, so the key is one devtools tab away — and that key bypasses row-level security on every table.

Why flagged: A browser-side page reaching the database with credentials that aren't the anon key.

Fix: Rotate the key now; assume it is public. Delete it from the client, move the admin actions into an edge function, and have that function check the caller's role before it touches anything.

HighThe browser queries the database directly, without row-level security

security · React app → Supabase Postgres

Tables are reachable over HTTPS and RLS is off, so the filters in your code are a suggestion. Changing the request in devtools — or just removing the `.eq('user_id', me)` — returns every row in the table.

Why flagged: Client → database edge with no server-side code between them.

Fix: Enable RLS on every table and write policies keyed on auth.uid(). Treat the anon key as public, because it is: the policy is the access control, not the query.

MediumNo rate limit on sign-in

security · Supabase Auth

The auth endpoint accepts unlimited attempts from one address. That is enough for credential stuffing against a leaked password list, and there is nothing in the logs that would make it obvious.

Why flagged: Public auth endpoint with no limiter node or policy in front of it.

Fix: Turn on the captcha and attempt limits in Supabase Auth settings, and add a per-IP limit in front of it if you can put the app behind a proxy.

LowThe uploads bucket is public

security · Supabase Storage

Object URLs are hard to guess but not private: once one is shared, pasted into a support ticket, or indexed, anyone can open it forever.

Fix: Make the bucket private and hand out signed URLs with a short expiry. Keep it public only for genuinely public images.

LowThe Stripe webhook is not idempotent

reliability · Stripe → Edge Functions

Stripe retries a webhook until it gets a 2xx. If the handler times out after it has already written the row, the retry writes it again — double credits, double emails.

Fix: Store the Stripe event id and ignore ids you have already processed, in the same transaction as the write.

InfoEvery summary is a fresh model call

cost · Edge Functions → OpenAI API

Nothing caches identical prompts, so the model bill scales with page views rather than with unique content.

Fix: Cache the summary next to the row it describes and regenerate only when the source text changes.