Sample report

What a shakedown report looks like

This is a sample, from a fictional app. It shows the shape of what you get back: a ranked list of findings, each written in plain English — what it is, what goes wrong if you don't fix it, and the fix your own AI can apply.

Sample — a fictional app, not a real client

Shakedown report

Sample app: "Bookly" — a fictional booking app

Sample

Findings

Critical

High

Open after fixes

Exposed API key in the client bundle

Critical

What it is

A Supabase service-role key is bundled into the client. Anyone who opens the app can read it from the network tab and use it to read or write every row in the database.

If not fixed

Anyone who opens the app can read the key and use it to read or write your whole database — lost data, lost trust, and the bill for the damage.

The fix, as it would be handed back

Move the service-role key to the server. The client should only ever hold the anon key. Rotate the exposed key now — treat it as compromised.

Open data: any visitor can list every record

Critical

What it is

The bookings table has no row-level security. A logged-out visitor can list every booking, including other people's details.

If not fixed

Any visitor can list every record, including other people's — lost data, lost trust, and the public postmortem.

The fix, as it would be handed back

Add a row-level security policy so each user can only read and write their own bookings. The policy is written so your AI can apply it.

Database admin interface exposed to the public

Critical

What it is

A phpMyAdmin interface is reachable at /phpmyadmin on the live site. It's the tool for managing the database, and it's wired to the public internet.

If not fixed

Anyone who finds the URL has your data or can reset your data — and it's a matter of time before a scanner finds it.

The fix, as it would be handed back

Take the admin interface off the public internet — move it behind a VPN or a private network, and remove the public route. The fix is written so your AI can apply it.

Broken access control on the admin route

High

What it is

The /admin route checks that a user is logged in, but not that they have the admin role. Any logged-in user can reach it.

If not fixed

A stranger can do what only you should be able to — change prices, read other people's data, or take the app down.

The fix, as it would be handed back

Add a role check to the /admin route guard. The pattern is written so the same check can be applied to the other admin routes.

Secrets committed to the repo history

High

What it is

A Stripe secret key was committed in an early commit and is still in the history. Removing it from the current file does not remove it from the history.

If not fixed

Anyone with the repo can read the key and charge your customers or read their payment details — lost data, lost trust, and a chargeback you can't explain.

The fix, as it would be handed back

Rotate the Stripe key. Add the secret to .gitignore. The history note explains how to purge it if the repo is public.

No source control

High

What it is

The code has no git history and no remote backup. The only copy is the one running in production.

If not fixed

You can't undo a bad deploy, you can't restore from a broken migration, and your AI can't safely work in the codebase because there's no rollback. One bad change and the only copy is the broken one.

The fix, as it would be handed back

Set up a git repo with a remote backup, and a rollback story your AI can work within. The setup is written so your AI can apply it.

What comes with the report

Every finding is ranked, so you know what to fix first
Every finding is written in plain English — what it is, what goes wrong if you don't fix it, and the fix
Every finding ships with a fix your own AI can apply
A walkthrough of the report, so you understand what you're looking at
The "engineer ready" clean-up, so the next change costs less

Get a report like this, for your app

Send a few details and you'll get a fixed quote for the size of your app, up front.

Book a shakedown