Guides

Findings, explained

One page per finding class. Each starts from what SecScan actually reported, explains why it is graded the way it is, and ends with the change that clears it.

High Missing Content-Security-Policy What a Content-Security-Policy header does, why SecScan reports its absence as High, and how to ship one without breaking your app. High Cookie flags: Secure, HttpOnly, SameSite Why a session cookie missing Secure is High while the same gap on an analytics cookie is Low, and how to set all three flags correctly. Critical Supabase tables readable with the anon key CVE-2025-48757: how a Supabase project ships with Row Level Security off, why the anon key is not the problem, and how to confirm and fix it. High SPF, DKIM and DMARC Three DNS records decide whether anyone can send email as your domain. What SecScan checks, and the exact records to publish. Critical Exposed .env files and source maps Two ways a deploy publishes things it never meant to: config files served as static assets, and source maps shipped next to production bundles. High Is my Lovable, Bolt or Cursor app secure? What to check The problems that most often reach production in apps built with AI tools (open databases, keys in front-end code, public config files) and how to check each one from the outside. Critical API keys exposed in JavaScript (OpenAI, Anthropic, Stripe, AWS) How a secret key ends up in front-end code, how to tell a secret key from a public one, and what to do the moment you find one. Critical Firebase security rules left open (Firestore, Realtime Database, Storage) How to tell whether your Firebase project is readable by anyone, and the rules that fix Firestore, Realtime Database and Cloud Storage. Medium Missing HSTS header (Strict-Transport-Security) What HSTS does, why an HTTPS site without it can still be downgraded, and the exact header to set on Nginx, Apache, Vercel, Netlify and Cloudflare. Critical IDOR and broken access control: how to test it Broken object-level authorisation is the most exploited flaw on the web. What it is, why it needs two accounts to find, and how to fix it.