Solutions · Weekend build
You built it fast. Now find out what that cost.
It runs, people can use it, and you are proud of it. But moving that fast leaves specific things behind — the same ones almost every time.
The situation
Nobody told you what to check.
You built something real without a security review, because nobody offered you one.
You described what you wanted, a tool built it, you adjusted until it worked. Somewhere in that loop the question of who is allowed to read what never came up, because it never had to for the app to function.
That gap is not a failure of skill. It is a gap in what the tools tell you. A generated app is judged on whether it works, and a leaking database works perfectly.
So the useful thing is not advice. It is a specific list: this table is open, this key is in the browser, this bucket is public, in this file, on this line, and here is what someone could do with it today.
What usually turns up
The findings this moment tends to produce.
Drawn from the rule pack, not from anyone's repo. Your report will differ — this is the shape of it.
The database that trusts the frontend
The most common serious finding in this kind of project. Your interface checks who is signed in; your database checks nothing. With the public key from your own frontend, anyone reads every row.
The admin key that ended up in the browser
A key labelled service-role, admin or secret, used in browser code because it was the one that made the request work. It bypasses every rule you have set, and it is readable by anyone who opens devtools.
The bucket nobody set back to private
An uploads bucket set to public because that is how the tutorial had it, or a signed URL with no expiry, which is a public URL with extra steps.
Everything git remembers
Packages, and secrets across your whole history rather than just the current files. This part does not care how fast you built — it reads what git kept.
How it fits
Read it once, properly, in this order.
One scan, read end to end. Worth the ten minutes here.
- 01
Scan what is actually live
Connect the repository read-only and scan the branch you actually deployed — not a tidy branch, the live one. The report is only useful if it describes what is running.
If you deployed from your default branch, that is the one to scan.
- 02
Work from the top down
Start at the top. Findings are ranked by what someone could do with them, not by which scanner produced them, so the first item is the one to deal with first.
Critical and high findings are shown in full on the free plan. Medium and low are capped until you upgrade.
- 03
Rotate keys first
Rotate before you refactor. If a live key is exposed, replacing the key in your hosting provider kills the old one immediately — moving it into an environment variable does not.
The report says this too, in the fix step, in this order, for exactly this reason.
- 04
Then handle what we could not check
Read the not-checked items last, and deal with them yourself. Each one comes with what evidence was missing and where to look for it in your hosting dashboard.
These are the ones other scanners quietly count as a pass. They are usually where the real problem is.
A fast build usually means the risky parts were never written down.
A tool that generated your code cannot tell you what it got wrong, and neither can a scan that only reads the repository. If your app depends on a service you configured entirely through a web dashboard, the rules that protect your data are not in the code we can read. We will say so — clearly, in the report, in the place the answer would have been.
Point it at the thing you built last weekend.
One scan, about a minute, on the free plan. You do not need to have cleaned anything up first.