CHECKS
Everything SetRepo checks
106 checks across your code, its dependencies, its configuration and your live site. Quick scans run every check except the AI review, which deep scans add. Live-site checks run when you add your URL; the ones that look for exposed files and open data run only on a domain you verify.
Access control32
- IDOR: records loaded by ID without an ownership checkQuick + DeepRead guide
- AI review of access control and IDORDeepRead guide
- Admin endpoints with no authenticationQuick + DeepRead guide
- Admin endpoints that check login but not roleQuick + DeepGuide coming soon
- Endpoints that change data without authenticationQuick + DeepGuide coming soon
- Unauthenticated endpoints that call paid AI APIsQuick + DeepGuide coming soon
- Pages protected only in the browserQuick + DeepGuide coming soon
- Supabase Row Level Security turned offQuick + DeepRead guide
- Supabase policies that allow every rowQuick + DeepGuide coming soon
- Public Supabase storage bucketsQuick + DeepGuide coming soon
- Supabase tables readable with the anon key (live, verified domains)Quick + DeepGuide coming soon
- Firebase security rules open to anyoneQuick + DeepGuide coming soon
- Firebase Realtime Database readable by anyone (live, verified domains)Quick + DeepGuide coming soon
- Firestore readable by anyone (live, verified domains)Quick + DeepGuide coming soon
- JWT read without signature verificationQuick + DeepGuide coming soon
- JWT signed without an expiryQuick + DeepGuide coming soon
- Auth token stored in localStorageQuick + DeepGuide coming soon
- Auth token returned in the body for bearer useQuick + DeepGuide coming soon
- No logout or token revocationQuick + DeepGuide coming soon
- Logout that doesn't revoke the session or tokenQuick + DeepGuide coming soon
- No refresh-token flowQuick + DeepGuide coming soon
- Cookie sessions without CSRF protectionQuick + DeepGuide coming soon
- Login and signup endpoints without rate limitingQuick + DeepGuide coming soon
- Export and password-reset endpoints without rate limitingQuick + DeepGuide coming soon
- Account enumeration through login or reset responsesQuick + DeepGuide coming soon
- Password-reset token returned in the responseQuick + DeepGuide coming soon
- Password-reset tokens that never expireQuick + DeepGuide coming soon
- Passwords hashed with a fast, unsalted hashQuick + DeepGuide coming soon
- Non-cryptographic randomness for tokensQuick + DeepGuide coming soon
- MD5 or SHA-1 used for security tokensQuick + DeepGuide coming soon
- Mass assignment from the request bodyQuick + DeepGuide coming soon
- One handler serving read and write methods uncheckedQuick + DeepGuide coming soon
Business logic3
- Prices and totals trusted from the clientQuick + DeepRead guide
- Webhooks without signature verificationQuick + DeepGuide coming soon
- AI review of business logicDeepGuide coming soon
Secrets6
- Secrets in code and git historyQuick + DeepRead guide
- Hardcoded token-signing secretsQuick + DeepGuide coming soon
- Supabase service_role key in client codeQuick + DeepRead guide
- Supabase service_role key in public JavaScript (live)Quick + DeepGuide coming soon
- API keys and tokens in the JavaScript your site serves (live)Quick + DeepGuide coming soon
- Real values in template env filesQuick + DeepGuide coming soon
Injection6
- SQL injection from request inputQuick + DeepRead guide
- NoSQL injectionQuick + DeepGuide coming soon
- Supabase filter injectionQuick + DeepGuide coming soon
- Open redirects from user inputQuick + DeepGuide coming soon
- Python security issues (Bandit)Quick + DeepGuide coming soon
- JavaScript security lint rules (ESLint)Quick + DeepGuide coming soon
Dependencies2
- Known-vulnerable dependenciesQuick + DeepRead guide
- End-of-life runtimesQuick + DeepGuide coming soon
Infra & config18
- CORS allows any origin with credentialsQuick + DeepRead guide
- Dev origins in the production CORS allowlistQuick + DeepGuide coming soon
- Debug mode enabledQuick + DeepGuide coming soon
- Debug endpoints exposed as routesQuick + DeepGuide coming soon
- Containers running as rootQuick + DeepGuide coming soon
- chmod 777 in a DockerfileQuick + DeepGuide coming soon
- Dockerfile and infrastructure misconfigurationQuick + DeepGuide coming soon
- Containers without resource limitsQuick + DeepGuide coming soon
- Internal addresses hardcoded in sourceQuick + DeepGuide coming soon
- Outbound HTTP calls without a timeoutQuick + DeepGuide coming soon
- Rate limiter using in-process storageQuick + DeepGuide coming soon
- Session store in process memoryQuick + DeepGuide coming soon
- Cacheable responses next to authenticated routesQuick + DeepGuide coming soon
- Per-user responses without a Vary headerQuick + DeepGuide coming soon
- No Cache-Control policy on an authenticated appQuick + DeepGuide coming soon
- File uploads without type validationQuick + DeepGuide coming soon
- Missing database indexesQuick + DeepGuide coming soon
- Missing foreign keysQuick + DeepGuide coming soon
Live site39
- No Content-Security-Policy headerQuick + DeepGuide coming soon
- No HSTS headerQuick + DeepGuide coming soon
- Short HSTS max-ageQuick + DeepGuide coming soon
- X-Content-Type-Options not set to nosniffQuick + DeepGuide coming soon
- No Referrer-Policy headerQuick + DeepGuide coming soon
- No clickjacking protectionQuick + DeepGuide coming soon
- Server version disclosed in headersQuick + DeepGuide coming soon
- Cookies without the Secure attributeQuick + DeepGuide coming soon
- Cookies without the HttpOnly attributeQuick + DeepGuide coming soon
- Cookies with a weak SameSite settingQuick + DeepGuide coming soon
- HTTP not redirecting to HTTPSQuick + DeepGuide coming soon
- HTTP redirecting somewhere other than HTTPSQuick + DeepGuide coming soon
- HTTP TRACE method enabledQuick + DeepGuide coming soon
- Risky HTTP methods exposedQuick + DeepGuide coming soon
- Directory listing enabled (verified domains)Quick + DeepGuide coming soon
- Downloadable .env files (verified domains)Quick + DeepGuide coming soon
- Downloadable .git folder (verified domains)Quick + DeepGuide coming soon
- Downloadable backup archives (verified domains)Quick + DeepGuide coming soon
- Downloadable database dumps (verified domains)Quick + DeepGuide coming soon
- Exposed .DS_Store files (verified domains)Quick + DeepGuide coming soon
- Public JavaScript source mapsQuick + DeepGuide coming soon
- HTTPS not availableQuick + DeepGuide coming soon
- TLS certificate that doesn't validateQuick + DeepGuide coming soon
- Expired TLS certificateQuick + DeepGuide coming soon
- TLS certificate expiring within daysQuick + DeepGuide coming soon
- TLS certificate expiring within a monthQuick + DeepGuide coming soon
- TLS 1.1 or older still enabledQuick + DeepGuide coming soon
- Weak TLS ciphersQuick + DeepGuide coming soon
- Possible subdomain takeoverQuick + DeepGuide coming soon
- No CAA recordsQuick + DeepGuide coming soon
- DNSSEC not enabledQuick + DeepGuide coming soon
- No NS recordsQuick + DeepGuide coming soon
- Only one nameserverQuick + DeepGuide coming soon
- Domain registration expiredQuick + DeepGuide coming soon
- Domain registration expiring soonQuick + DeepGuide coming soon
- No SPF recordQuick + DeepGuide coming soon
- No DMARC recordQuick + DeepGuide coming soon
- DMARC set to monitor onlyQuick + DeepGuide coming soon
- DKIM not foundQuick + DeepGuide coming soon