Fix these before strangers use your app

Demo findings are showing until your first live scan writes results into Supabase.

Active findings

Plain-English risks ranked by launch impact.

A Supabase rule change made customer records readable by anonymous users.

supabase/migrations/202605041830_customers.sql:18

The chat endpoint can call OpenAI without login or a per-user quota.

src/app/api/chat/route.ts:9

A webhook handler accepts event payloads without verifying Stripe's signature header.

src/app/api/stripe/webhook/route.ts:14

A private-looking model provider key appears in the deployed JavaScript bundle.

.env.production:4

The admin page renders protected controls before a server-side role check.

src/app/admin/page.tsx:31