How we rate

Every check uses the same rules. A Supabase anon key on its own is Info. It is High only when that key returns rows that should be private. Missing security headers are Low or Medium, never Critical.

1. Info

   A Supabase anon key or publishable key on its own is Info. Those keys are meant to be in the browser. The key becomes a problem only when it can read data.

2. Low

   A missing security header, or a cookie missing Secure, HttpOnly, or SameSite, is Low. A missing header is never Critical.

3. Medium

   A CORS wildcard combined with credentials is Medium. A Supabase or Firebase endpoint that answers without a login but returns no rows is Medium. A certificate that expires within 14 days is Medium. A Stripe test secret in the browser is Medium.

4. High

   A table that returns rows to the anon or publishable key, when those rows are not personal or payment data, is High. Open Firebase rules that answer without a document or child value are High. An expired, untrusted, or mismatched certificate is High.

5. Critical

   A service-role or sb_secret key, a live Stripe secret (sk_live_ or rk_live_), another live secret in client JavaScript, or a public .env that contains assignments is Critical. A table that returns personal or payment data without a login is Critical. Firebase rules that return user data without a login are Critical.

What we cannot see from outside

• Server code that never reaches the browser.
• Whether a login session is checked correctly after the visitor signs in.
• Row level security for a role this scan does not have.
• Data that is only returned after a form POST.
• Secrets that exist only in the host's private environment and are not shipped in the page, the scripts, or a public file.

Run a free scan. The free result names every finding. A High or Critical finding includes the request on the Proof Report.