WalkaroundLAUNCH CHECK · SAMPLE
DO NOT SHIP
3
ways in
DESKTOP WIDTH. This sample page, photographed from outside it, with nothing clicked and nothing typed.
PHONE WIDTH, cropped to the top of the page. The checks are the lines below, run against the requests they made: a photograph is not one of the twelve, and it cannot tell you what a stranger can reach.
These two photographs are of this sample page, taken from outside it at desktop and phone width. They are on our sample receipts: they are a look at the page, not part of the check.
×KEY IN PAGEEXPOSED
A live secret (sk_test_) is in the JavaScript your site ships to every browser.
index-fea9.js line 10:
"sk_test_":"sk_test_51WalkaroundDemo……"
PASTE THIS INTO LOVABLEsk_test_ is in the browser bundle. Move every use of it to the server side, remove it from the client code, and then rotate it at the provider so the copy that shipped stops working. If you only remove it from the code, the old key is still usable by anyone who saved it.
×PUBLIC FILESOPEN
Anyone can list and download every uploaded file. 5 shown before the cap, including one named guest-id-emma-thornton.jpg.
POST https://featherbed.walkaround.dev/storage/v1/object/list/documents
200 OK → ["guest-id-emma-thornton.jpg", "booking-agreement-fb-48213-signed.pdf", "guest-id-rowan-price.png"]
POST https://featherbed.walkaround.dev/storage/v1/object/list/uploads
200 OK → ["cot-request-kilm-cottage.jpg", "parking-permit-salt-loft.pdf"]
PASTE THIS INTO LOVABLEMake the bucket private and stop serving files by direct public URL. Files should be reachable only through a signed link I create in the app after checking the user is signed in. Tell me which pages call it so I can fix them too, then make the same listing request again to confirm it is refused.
×OPEN SIGNUPSOPEN
Anyone can create an account with an address they do not own, because signups are open and confirmation is off.
GET /auth/v1/settings
mailer_autoconfirm: true
disable_signup: false
PASTE THIS INTO LOVABLETurn email confirmation back on in Supabase authentication settings, so an account only starts working once the address is confirmed. Anyone can currently register with an address that is not theirs.
✓TABLE RULESPASS
Tables answered but handed over no rows (stays, bookings, guests and 1 more). Rules are on.
✓ROUTE AUTHPASS
2 of the 8 app routes sampled sent an anonymous request to a login page. Nothing answered with data.
✓RECORDS BY IDPASS
Asking for a record by id came back empty for a stranger. There is nothing to hand over.
✓ENV IN CLIENTPASS
No config file or client-side env object with non-public values was found.
✓ADMIN ROUTESPASS
The admin addresses probed did not answer a stranger.
✓SUPABASE CONFIGPASS
Project found and the key the browser gets is the public one (role: anon). That is how it should be.
✓SOURCE MAPSPASS
No source map or source directory reachable (2 tried).
✓SECURITY HEADERSPASS
HSTS and CSP are both present on https.
–AUTH SETTINGSNOT CHECKED
The settings endpoint answered but carried no redirect list, so there was no redirect configuration to judge from outside.
CHECKED: 12. SKIPPED: nothing — all twelve ran. NOT REACHABLE: anything behind a login; the server behind the app, and your Supabase console.
SAMPLE RECEIPT. This is one of our own demo apps, and every line on it is unsealed and free to read. Nothing on this receipt is for sale.
WHAT THIS IS NOT. Twelve checks against the outside of your app in 0.17 seconds, on 20 OCT 2026.
CHECKED: 12.
SKIPPED: nothing — all twelve ran.
NOT REACHABLE: anything behind a login; the server behind the app, and your Supabase console.
A clean receipt is not a guarantee of safety, and an open line is not a break-in: it is a door left unlocked, and anyone can try the handle.
ref 87 reed 6 lilac wren · walkaround.app
Walkaround · twelve checks, a dated receipt, and the fix to paste back into the tool that built your app.
It is not a penetration test, and it looks behind a login only when you hand it one to look with.
What it costs · status · Terms · Privacy · Refunds