Get free Vitals

Catalog 2026.10.15

Checks

Each check has an ID, a severity and a plain-English explanation. 63 checks are enabled.

data

  • SEC-001 · Secret committed in repo (current tree) · P0
  • SEC-002 · Secret in git history · P1
  • SEC-003 · Service-role or secret key in client bundle · P0
  • SEC-004 · Public env prefix on a secret · P0
  • SEC-005 · AI provider key used from browser · P0
  • SEC-006 · .env file committed · P0
  • DB-001 · Supabase table readable anonymously · P0
  • DB-002 · RLS disabled on table · P0
  • DB-003 · Policy allows anyone to write · P0
  • DB-004 · Public storage bucket with user uploads · P1
  • DB-005 · Firestore or Realtime Database rules open · P0
  • DB-009 · SQL built by string concat · P1
  • DB-010 · security definer function without search_path · P1
  • PORT-001 · Database port publicly reachable · P0
  • PORT-003 · .git or .env served over HTTP · P0

payments

  • PAY-001 · Stripe webhook without signature verification · P0
  • PAY-002 · Price or amount taken from client · P0
  • PAY-003 · Paid access granted on redirect not webhook · P1
  • PAY-004 · Webhook handler not idempotent · P1
  • PAY-005 · Stripe live secret in frontend · P0
  • PAY-006 · No handling of failed invoice or deleted subscription · P2
  • WH-001 · Inbound webhooks unsigned · P1
  • WH-002 · Webhook replay drill failing · P1

auth

  • SEC-008 · Hard-coded admin email or password · P0
  • AUTH-001 · Admin route without auth check · P0
  • AUTH-002 · Authorization by client-side flag only · P0
  • AUTH-003 · Supabase user_metadata used for roles · P1
  • AUTH-004 · Email confirmation disabled with paid features · P2
  • AUTH-005 · Missing rate limit on login, signup or OTP · P1
  • AUTH-006 · JWT verified without algorithm, issuer or audience · P1
  • AUTH-007 · Session cookie without HttpOnly, Secure or SameSite · P1
  • AUTH-008 · Password reset token predictable or without expiry · P1
  • AUTH-009 · IDOR: resource fetched by id without owner check · P0
  • HDR-005 · CORS allows any origin with credentials · P1

availability

  • DB-006 · No backups or point-in-time recovery · P1
  • DB-007 · Backups never restore-tested · P1
  • TLS-001 · Certificate expires in under 14 days · P1
  • TLS-002 · TLS below 1.2 accepted · P1
  • TLS-003 · HTTP not redirected to HTTPS · P1
  • PORT-002 · Admin panels exposed · P1
  • DEP-001 · Dependency with known critical CVE · P1
  • DEP-002 · Dependency with high CVE · P2
  • AVL-001 · No error tracking · P2
  • AVL-002 · No health endpoint · P2
  • AVL-003 · No rollback path · P1
  • AVL-004 · Unbounded AI spend · P1
  • AVL-005 · No uptime monitor · P2

hygiene

  • SEC-007 · Source maps public in production · P2
  • DB-008 · Migrations not in repo · P2
  • HDR-001 · Missing HSTS · P2
  • HDR-002 · Missing CSP · P2
  • HDR-003 · Clickjacking: no frame-ancestors or X-Frame-Options · P2
  • HDR-004 · X-Content-Type-Options missing · P2
  • HDR-006 · Server or version banner leak · P2
  • TLS-004 · Mixed content · P2
  • DEP-003 · No lockfile · P2
  • DEP-004 · Abandoned or typosquat package · P1
  • HYG-001 · No tests at all · P2
  • HYG-002 · TypeScript strict off or ignoreBuildErrors · P2
  • HYG-003 · Console logs of tokens or personal data · P1
  • HYG-004 · Debug or test routes left in production · P1
  • HYG-005 · dangerouslySetInnerHTML with user input · P1
  • HYG-006 · Open redirect · P2
Checks — Rivyva