Security report
https://meu-app.lovable.app
14 findings
This score covers the public surface — what a visitor reaches without logging in. It does not include the logged-in area, what runs on the server, nor other subdomains (api., staging., admin.). The full scope is further down.
- 24
- pages visited
- 1,010
- checks run
- 14
- findings
Work transparency
What we combed through
A real sweep, in a real browser: 24 pages opened and 1,010 checks run.
Pages visited (24)
- https://meu-app.lovable.app/
- https://meu-app.lovable.app/login
- https://meu-app.lovable.app/cadastro
- https://meu-app.lovable.app/painel
- https://meu-app.lovable.app/conta
- https://meu-app.lovable.app/checkout
- https://meu-app.lovable.app/precos
- https://meu-app.lovable.app/sobre
- https://meu-app.lovable.app/contato
- https://meu-app.lovable.app/blog
- https://meu-app.lovable.app/blog/post-1
- https://meu-app.lovable.app/blog/post-2
- https://meu-app.lovable.app/termos
- https://meu-app.lovable.app/privacidade
- https://meu-app.lovable.app/faq
- https://meu-app.lovable.app/recuperar-senha
- https://meu-app.lovable.app/status
- https://meu-app.lovable.app/api/health
- https://meu-app.lovable.app/sitemap.xml
- https://meu-app.lovable.app/robots.txt
- https://api.meu-app.lovable.app/
- https://staging.meu-app.lovable.app/
- https://meu-app.lovable.app/assets/index.js
- https://meu-app.lovable.app/assets/vendor.js
Checks by category
- Exposed secrets320
- HTTP headers170
- Sensitive files120
- Browser storage90
- Database70
- DNS / email60
- Frontend libraries50
- api40
- Cookies40
- CORS (cross-origin)20
- Transport / TLS18
- Resilience (CDN/WAF)12
Full report · US$ 49
You already know what’s broken. You’re missing where.
The full report opens the proof of each of the 14 findings: the exact file and line, the before-and-after code, the
- ✓ Where each flaw is — file, line, endpoint
- ✓ Fix prompt per assistant + before/after code
- ✓ How to verify the fix took
- ✓ Retest included: the second pass costs nothing
- ✓ Exportable report, to archive or hand to your client
Guarantee: if the paid report confirms no high or critical finding, we refund the US$ 49.
Action plan
In this order, not another.
0→100
score after everything · ~6 h 45
the score has a ceiling; the risk slice does not
1Fix today — it’s what opens the door
~4 h 10−93% of the risk- .env file exposed20 min
- Exposed secret: Stripe30 min
- Exposed Supabase service_role key35 min
- Firebase database open45 min
- Session cookie without HttpOnly15 min
- Exposed secret: OpenAI25 min
- Public storage bucket40 min
- Personal data in the browser40 min
2This week — close the gaps
~1 h 45−5% of the risk- DMARC missing15 min
- GraphQL introspection open20 min
- Library with a known flaw30 min
- Content-Security-Policy missing40 min
3When you can — hygiene and reputation
~50 min−1% of the risk- Scripts without integrity check20 min
- Forgotten subdomains found30 min
Order-of-magnitude estimates, for a dev who knows the project. The risk slice and the score projection use the same weight table as the scan — so the number here is what the retest will show.
Scope of this analysis
What was looked at — and, just as clearly, what wasn’t.
In
- The public pages the browser reached from the address you gave
- Every file the site serves to the browser — bundles, scripts, config
- Response headers, session cookies, CORS policy, and TLS configuration
- The domain’s email DNS records (SPF and DMARC)
- Frontend libraries with a known public flaw
- Sensitive files at known paths (.env, .git, backups)
Out
- Everything that only exists after login — we don’t authenticate on your site
- The code that runs on the server: SQL injection, business logic, cross-user permissions
- Server-side dependencies — from outside we only see what the browser downloads
- Infrastructure off the site: database ports, buckets, panels on other subdomains
- Whatever you publish after this scan — the surface changes on every deploy
- The active database test, which requires domain verification
No scan makes a system secure — this one closes the doors that are open to anyone arriving from outside, with no password and no technical knowledge, which is where most incidents in new apps actually happen. The surface changes with every deploy: a scan is a snapshot, not insurance.
Compliance (indicative)
Which standards these findings touch
The findings in this report map to controls in the following frameworks:
Indicative mapping to guide remediation — it is not a compliance assessment or certification, and doesn’t replace an audit.
Exposed Supabase service_role key
Your database master key sits in the code any visitor downloads. With it, a stranger reads, edits, and deletes everything — bypassing every access rule you set.
Sensitive data (like the login token) is stored in the browser in a way another script can read — and steal the access.
Exposed secret: Stripe
The Stripe secret key was left in the site. It can issue refunds, pull up your customer list, and touch your payments account — all in your name.
A password or access key ended up visible in the site’s code. Anyone who opens the page finds it — and can use your account, spend in your name, or read your data.
.env file exposed
The .env file is open to the public. It holds every password and key at once — the treasure map served on a platter.
A file that should be private (config, backup) is open on the internet. It’s like leaving the key under the mat, in plain sight.
Firebase database open
Your Firebase database answers with no login. Anyone reads your users’ data, and if writing is open too, edits it — no password, no barrier.
The database can be accessed directly, without the permission rules. In practice, anyone can read (or change) every user’s data.
Session cookie without HttpOnly
The cookie that keeps a user logged in can be read by a script on the page. That alone lets an attacker sign in as them.
The cookie that keeps the user logged in has no protection. That makes it easy to steal the session and get into the system as them.
Personal data in the browser
Your customers’ personal data — card numbers, IDs — is kept in the browser, within reach of any script. It’s a leak and a privacy fine waiting to happen.
Sensitive data (like the login token) is stored in the browser in a way another script can read — and steal the access.
Public storage bucket
A file bucket (S3/Storage) is listable. Documents, uploads, and backups that should be private can be listed and downloaded one by one.
A file that should be private (config, backup) is open on the internet. It’s like leaving the key under the mat, in plain sight.
Exposed secret: OpenAI
Your OpenAI key leaked in the site. Whoever finds it spends on your quota; the bill, at month’s end, is yours.
A password or access key ended up visible in the site’s code. Anyone who opens the page finds it — and can use your account, spend in your name, or read your data.
Content-Security-Policy missing
With no CSP, an injected script runs free on your page — stealing your users’ data and sessions with no warning.
Basic protections the browser uses to block attacks are missing. Without them, it’s easier to inject malicious code or "hijack" the user’s screen.
GraphQL introspection open
The full map of your API — every field and operation — is public. It hands an attacker the blueprint before they even try.
A site endpoint is open or accepting dangerous actions. It can be used to extract data or abuse the system.
Library with a known flaw
Your site loads a library with a public, already-patched flaw. It’s an old unlocked door — bots know exactly how to walk in.
A library the site uses has a known public flaw. It’s a door attackers already know to look for.
DMARC missing
With no DMARC, anyone can email posing as your domain. Your customer falls for the scam, and the lost trust is yours.
Your domain’s email is missing its locks. Without them, scammers can send email "in your company’s name" (phishing) — and your customers fall for it.
Forgotten subdomains found
We found subdomains you left online (api., staging.). Each is one more door — and the forgotten ones tend to be the weakest.
Your domain’s email is missing its locks. Without them, scammers can send email "in your company’s name" (phishing) — and your customers fall for it.
Scripts without integrity check
Third-party scripts load with no integrity check. If the provider is compromised, malicious code walks straight into your site.
A library the site uses has a known public flaw. It’s a door attackers already know to look for.
OWASP and CWE classifications are public technical references. The LGPD/GDPR seal is indicative — it flags findings that may leave personal data within third parties’ reach and does not replace legal review.