$ coprompt scan https://linkbase.app --tier 0
GET https://linkbase.app  200  1.2s
stack · Supabase · Vercel · Resend detected
fetching client bundle … 2.4 MB
running 30 checks …
■ critical  anon key exposed — public.users readable (1,284 rows)
■ critical  service_role key in client bundle · main.js:1
◆ high      preview deploy shares prod database (312 rows)
◆ high      /api/admin reachable without auth
auth policies …
  public.users     RLS  OFF
  public.orders    RLS  OFF
  public.messages  RLS  OFF
▲ medium    missing headers ×3 — CSP · HSTS · X-Frame
▲ medium    CORS allows * on api.linkbase.app
▲ medium    .env.local committed 4 commits ago
storage bucket "avatars" … public-read
JWT secret entropy … weak (guessable)
rate limiting … none on /auth/login
secrets scan … 2 live keys found
  › STRIPE_SECRET_KEY  sk_live_…  active
  › RESEND_API_KEY     re_…      active
dependency audit … 3 high · 7 moderate
agent trace … tool calls unsandboxed
prompt-injection surface … 4 inputs unescaped
client routes … 6 pages leak internal ids
email DNS … SPF ok · DMARC missing
30 scanners · 13 findings · 2 critical · 2 high · 4 medium
exposure … 1,596 records readable without auth
report ready → coprompt.dev/r/8a31c9
$ _

Security on autopilot
for AI-built apps

Finds what your coding agent missed — before someone else does.

Used by customers of