Hi,

Here's the security report you asked for.

Site: https://demo-sample.shiplatch.com/
Grade: F
Issues: 2 critical · 1 high · 2 medium · 2 low

What the severity levels mean:
- Critical: Someone can likely take your data or take control right now.
- High: Someone could use this against your app today.
- Medium: Weakens your defenses, but needs a second mistake to exploit.
- Low: Good hygiene. Little direct risk on its own.

Fix this first:
[CRITICAL] Stripe secret/restricted key exposed in client code

Why it matters: Anyone can copy this key and act as your Stripe account: issue refunds, read customers, or create charges.

Fix it and prove it with the Fix Pack ($29 one-time): copy-paste prompts plus 2 re-scans that prove the fix:
https://shiplatch.com/sample

Not ready for the Fix Pack? The $9 playbook teaches you to fix these yourself:
https://shiplatch.com/ebook/buy?src=sandbox

Every finding:
- [CRITICAL] Stripe secret/restricted key exposed in client code (Anyone can copy this key and act as your Stripe account: issue refunds, read customers, or create charges.)
- [CRITICAL] Supabase service_role key exposed in client code (bypasses all RLS) (This key skips every database rule. Anyone can read, change, or delete all of your data.)
- [HIGH] Resend API key exposed in client code (Anyone can copy this key and send email as you, which can get your domain blacklisted.)
- [MEDIUM] No Content-Security-Policy header (Without this header, an injected script has an easier time stealing user sessions.)
- [MEDIUM] Secret-looking value in public env var VITE_ADMIN_TOKEN (VITE_ variables are bundled into the browser) (Public env vars are built into the JavaScript every visitor downloads, so anyone can copy this secret and use it as you.)
- [LOW] No Referrer-Policy header (Full page URLs, sometimes with tokens in them, can leak to other sites.)
  Paste this into your AI builder:
  Add Referrer-Policy: strict-origin-when-cross-origin
  Copy-paste snippets for Vercel, Netlify and Cloudflare are in your report: https://shiplatch.com/sample
- [LOW] 1 source map(s) publicly served; your original source code is readable (Your original source code is readable, which makes bugs and secrets easier to find.)
- [INFO] Supabase anon key found (public by design; safety depends on RLS) (This key is meant to be public, but only if every table has Row Level Security switched on.)

Full report:
https://shiplatch.com/sample

A few notes:
- This was a passive scan. We loaded your public page and the scripts it serves, like a normal browser, plus a single check each for files that should never be public, like /.env and /.git.
- We didn't touch your database. Whether your Supabase or Firebase data is actually readable by strangers can only be tested after you verify you own the app.
- If a secret key showed up, rotate it now. Deleting it from the code doesn't help once it's been public.

The Fix Pack also adds the ownership-verified deep scan (read-only Supabase RLS + Firebase rules checks) and 2 re-scans to prove your fixes: https://shiplatch.com/sample

Questions? Just reply. A real person reads these.

Justin
ShipLatch

—
You're getting this because you asked for this security report at shiplatch.com for https://demo-sample.shiplatch.com/.
Unsubscribe: https://shiplatch.com/sample/email#unsubscribe-disabled-in-sample
ShipLatch · hello@shiplatch.com