SAMPLE · This is a sample. It shows everything the Fix Pack unlocks, run live by the real ShipLatch scanner on our own demo app (demo-sample.shiplatch.com). Every key in it is fake.

Sample Fix Pack report: what you get when you unlock

https://demo-sample.shiplatch.com/

Fix Pack view · score 0/100 · scanned live by the production scanner (2026-10-20 16:03 UTC)

3 critical1 high2 medium2 low

What the severity levels mean

Critical

Someone can likely take your data or take control right now.

High

Someone could use this against your app today.

Medium

Weakens your defenses, but needs a second mistake to exploit.

Low

Good hygiene. Little direct risk on its own.

What the Fix Pack unlocks

Every finding in full: where it is, the evidence we found (keys are shown shortened), why it matters, and a copy-paste prompt for your AI builder. All 9 are below.
Verify you own the app (about 2 minutes): add one tag to your homepage, e.g. <meta name="shiplatch-verify" content="your-code">, or a file or DNS record.
Read-only deep scan of your database rules (Supabase RLS, Firebase rules), after you verify you own the app. On SampleShop it found 1 table anyone can read with the public key (orders, Critical, marked "Deep scan" below). SampleShop's database is a fake one we run for this demo (fake rows only). We only count rows, we never download them.
Paste the prompts, deploy, re-scan. 2 re-scans prove the fixes held. See the proof at the bottom.

All findings (unlocked)

What the Fix Pack adds: your exact file, your exact key, and proof the fix held.

Fix Pack · $29 one-time unlocks everything below for your own app.

Critical Stripe secret/restricted key exposed in client code

Where: JS /assets/index-d3m0s4mp.js · sk_live_…0000

Anyone can copy this key and act as your Stripe account: issue refunds, read customers, or create charges.

Roll the key in the Stripe Dashboard immediately.

🔒 In your Fix Pack, this is written for your exact file and key.

Critical Supabase service_role key exposed in client code (bypasses all RLS)

Where: JS /assets/index-d3m0s4mp.js · eyJhbGci…_000

This key skips every database rule. Anyone can read, change, or delete all of your data.

CRITICAL: anyone can read/write/delete your whole database.

🔒 In your Fix Pack, this is written for your exact file and key.

Critical Deep scan · Supabase table "orders" is readable with the public key (RLS missing or too open)

Where: orders · anonymous rows visible: 6

Anyone with your public key can read this table's rows.

Enable RLS on this table and add policies based on auth.uid().

🔒 In your Fix Pack, this is written for your exact file and key.

High Resend API key exposed in client code

Where: JS /assets/index-d3m0s4mp.js · re_SHIPL…0000

Anyone can copy this key and send email as you, which can get your domain blacklisted.

Revoke at resend.com/api-keys; send email from a server function.

🔒 In your Fix Pack, this is written for your exact file and key.

Medium No Content-Security-Policy header

Without this header, an injected script has an easier time stealing user sessions.

Add a Content-Security-Policy.

🔒 In your Fix Pack, this is written for your exact file and key.

Vercel (vercel.json)

Netlify (public/_headers, or netlify.toml below)

/*

Cloudflare Pages (public/_headers)

/*

Prompt for your AI builder

Add these HTTP security headers to every response my app serves (all routes, including the HTML page). Use my hosting's config file (vercel.json headers, a public/_headers file for Netlify or Cloudflare Pages, or netlify.toml). Don't change any app code.

Medium Secret-looking value in public env var VITE_ADMIN_TOKEN (VITE_ variables are bundled into the browser)

Where: JS /assets/index-d3m0s4mp.js · VITE_ADMIN_TOKEN=demo-fak…aa71

This weakens your defenses.

Anything in a VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_ or REACT_APP_ variable is compiled into the browser bundle.

🔒 In your Fix Pack, this is written for your exact file and key.

Low No Referrer-Policy headerFree on every scan

Full page URLs, sometimes with tokens in them, can leak to other sites.

Add Referrer-Policy: strict-origin-when-cross-origin

Vercel (vercel.json)

{
  "headers": [
    {
      "source": "/(.*)",
      "headers": [
        {
          "key": "Referrer-Policy",
          "value": "strict-origin-when-cross-origin"
        }
      ]
    }
  ]
}

Netlify (public/_headers, or netlify.toml below)

/*
  Referrer-Policy: strict-origin-when-cross-origin

# or in netlify.toml:
[[headers]]
  for = "/*"
  [headers.values]
    Referrer-Policy = "strict-origin-when-cross-origin"

Cloudflare Pages (public/_headers)

/*
  Referrer-Policy: strict-origin-when-cross-origin

Paste this into Lovable, Bolt or Cursor

Add these HTTP security headers to every response my app serves (all routes, including the HTML page). Use my hosting's config file (vercel.json headers, a public/_headers file for Netlify or Cloudflare Pages, or netlify.toml). Don't change any app code.
Referrer-Policy: strict-origin-when-cross-origin

Low 1 source map(s) publicly served; your original source code is readable

Your original source code is readable, which makes bugs and secrets easier to find.

Disable production source maps (e.g.

🔒 In your Fix Pack, this is written for your exact file and key.

Info Supabase anon key found (public by design; safety depends on RLS)

Where: JS /assets/index-d3m0s4mp.js · eyJhbGci…_000

This key is meant to be public, but only if every table has Row Level Security switched on.

Fine to be public, but only if every table has RLS enabled with correct policies.

🔒 In your Fix Pack, this is written for your exact file and key.

Re-scan proof

Deep step re-run on the fixed copy: Checked 1 Supabase table(s): no rows were anonymously readable. After the prompts above were applied, the same scanner re-scanned the fixed copy of SampleShop (demo-sample-fixed.shiplatch.com), live.

→

8 of 8 findings fixed

Score 0 → 100 · after: 0 critical 0 high 0 medium 0 low

Critical	Stripe secret/restricted key exposed in client code JS /assets/index-d3m0s4mp.js	Fixed ✓
Critical	Supabase service_role key exposed in client code (bypasses all RLS) JS /assets/index-d3m0s4mp.js	Fixed ✓
Critical	Supabase table "orders" is readable with the public key (RLS missing or too open) orders	Fixed ✓
High	Resend API key exposed in client code JS /assets/index-d3m0s4mp.js	Fixed ✓
Medium	No Content-Security-Policy header	Fixed ✓
Medium	Secret-looking value in public env var VITE_ADMIN_TOKEN (VITE_ variables are bundled into the browser) JS /assets/index-d3m0s4mp.js	Fixed ✓
Low	No Referrer-Policy header	Fixed ✓
Low	1 source map(s) publicly served; your original source code is readable	Fixed ✓

See the emails

The unlock email (sent when you enter your email) · The Fix Pack email (sent after checkout)

Want this for your own app?Scan your own app free Fix Pack · $29 one-time

Scan your app free

SampleShop is a fictional app run by ShipLatch for this sample; every key in it is fake and works nowhere. Viewing this page never unlocks or buys anything.