Before you point a domain at it.
You built it with an assistant, it works, and you cannot easily audit what was actually written. Connect the repository. In minutes, Security Check shows you what it found, what matters, and whether anything should stop your launch.
One free Security Check per repository. No card required. Paid scans include AI Review.
Don't ship yet
Three things here can be used against you as the code stands today.
- CriticalAnyone signed in can read every user's datasupabase/migrations/0002_profiles.sql
- HighThe admin check only runs in the browserapp/api/admin/users/route.ts
- HighAnyone can fake a successful paymentapp/api/webhooks/stripe/route.ts
The free Security Check gives you the report. Paid scans can review those findings automatically with AI — so you don't have to copy the report into another tool yourself.
Get the report first. Get more help when you need it.
Security Check is useful without AI. It scans your repository, explains what it finds in plain language, and gives you a clear verdict. When you run a paid scan, AI Review is included with the report so you can go from findings to next steps without moving the report somewhere else.
Know what is exposed
Your Security Check scans the repository and turns technical findings into plain-language explanations. You see what was found, how serious it is, and exactly where it lives in your code.
Know whether it should stop your launch
The report gives you a practical verdict instead of leaving you with a list of rule identifiers. An unverified payment webhook can be a launch blocker even when its scanner severity is moderate. A critical CVE in a build-only dependency may not be.
Let AI review the report for you
Paid scans include AI Review automatically. It takes the findings from your Security Check and helps explain the practical risk, identify what deserves attention first, and suggest how to address the issues — without you having to copy and paste the report into an AI chat yourself.
From security finding to a fix you can use.
You can always take your free report and ask your own AI assistant for help. With a paid scan, you don't have to. AI Review is already part of the report and gives you a focused explanation and remediation guidance for the findings that were detected.
In supabase/migrations/0002_profiles.sql the row-level security policy on `profiles` uses USING (true), which lets any authenticated user select every row. Write a new migration that drops that policy and creates one restricted to the owner (auth.uid() = user_id). Leave the insert and update policies alone. Then add a test that signs in as a second user and asserts they cannot select the first user's row. Do not disable RLS to make anything pass.
What the code scan looks for.
Individual rules, not headings — each one a specific pattern, in a specific language, matched against your source. Every Security Check runs all of them, on every plan, free or paid. Grouped here by the kind of flaw each one catches.
Injection
142 rules
SQL, cross-site scripting, command, LDAP and template injection, XXE, SSRF
Weak or misused cryptography
61 rules
Broken ciphers, predictable randomness, TLS that verifies nothing
Exposed secrets and sensitive data
58 rules
Credentials sitting in code, data written somewhere it can be read
Broken access control
57 rules
Authorization that checks the wrong thing, or never checks at all
Memory safety
49 rules
C and C++: use-after-free, double free, buffer overflow, format strings, integer overflow
Insecure configuration
48 rules
Dangerous defaults left switched on, container and workload config included
Unsafe failure handling
29 rules
Errors that crash the process, hang it, or hand the reader your internals
Authentication and session flaws
21 rules
Logins, tokens and sessions that can be forged, replayed or outlived
Insecure design
19 rules
Patterns that stay unsafe however carefully they are implemented
Integrity failures
14 rules
Code, updates and data trusted with nothing verifying where they came from
Unsafe deserialization
8 rules
Untrusted input turned back into live objects that then run
Known-vulnerable components
6 rules
Libraries and runtimes with published advisories against them
A rule can belong to more than one of these, so adding the counts up would count some of them twice — this is where the ruleset puts its weight, not a sum. And it is only the code scan: the credential scan and the dependency scan run alongside it on the same check, against their own detector sets. Every credential format and lockfile those two read
Where your code goes, and where it doesn't.
It is never run
Scanning reads files. Your repository is never built, installed or executed — no npm install, so no postinstall script of yours or anyone else's ever runs on our machines.
AI Review is explicit
A free Security Check does not use AI. Paid scans that include AI Review send the scan's findings — never your source code — to Anthropic's Claude. We tell you exactly what happens instead of hiding it behind "AI-assisted".
Secrets are masked first
The credential scan runs before anything is sent, so a key committed to your repo is masked before a single byte leaves. Otherwise our own finding becomes the thing that leaks it.
Delete means delete
Closing your account destroys the projects, the scan history and the repository tokens.
What this does not do.
A clean report means nothing blocking was found, by these tools, on that commit. It is not a guarantee and we will never word it as one. It does not open pull requests or change your code; it gives you the information and recommendations, and you stay in control of your repository.
AI Review is not a security guarantee either. It reviews the findings produced by the scan and provides additional analysis and recommendations. You should review any suggested fix before applying it.
It does not check accessibility either — doing that honestly means evaluating a rendered page, which means running your application, which is the one thing this service refuses to do to your repository. So that work has its own tool: audit.codexmotive.com. Two products because it is two boundaries, not because we ran out of time.
Start with a free scan.
Run one free Security Check on each repository — no card required. See the findings, understand what was detected, and get a clear launch verdict. When you need more scans, paid scans include AI Review automatically, giving you an additional analysis of the report without the manual copy-and-paste step.