WalkaroundLAUNCH CHECK · SAMPLE
DO NOT SHIP
2
ways in
DESKTOP WIDTH. This sample page, photographed from outside it, with nothing clicked and nothing typed.
PHONE WIDTH, cropped to the top of the page. The checks are the lines below, run against the requests they made: a photograph is not one of the twelve, and it cannot tell you what a stranger can reach.
These two photographs are of this sample page, taken from outside it at desktop and phone width. They are on our sample receipts: they are a look at the page, not part of the check.
×RECORDS BY IDREADABLE
Asking for one record by its number returned that record — with no login, from outside the app.
GET https://northwind.walkaround.dev/rest/v1/staff?id=eq.1&select=*
200 OK → 1 row, incl. id, created_at, email, full_name
GET https://northwind.walkaround.dev/rest/v1/staff?id=eq.2&select=*
200 OK → 1 row, incl. id, created_at, email, full_name
GET https://northwind.walkaround.dev/rest/v1/users?id=eq.1&select=*
200 OK → 1 row, incl. id, created_at, email, full_name
PASTE THIS INTO LOVABLEReading a row by its id is open to anyone. Add a policy on staff, users that only returns a row when the row belongs to the signed-in user, and make sure the id in the request cannot be swapped for someone else's. Then sign out and try the same request: it should come back empty.
×SOURCE MAPSEXPOSED
The deploy ships its own source directory, so anyone can read the original code behind the app.
GET https://northwind.walkaround.dev/src/
200 OK → 472 bytes readable
GET https://northwind.walkaround.dev/assets/index-nw7e.js.map
200 OK → 781 bytes readable
PASTE THIS INTO LOVABLEThe build is publishing sources together with the site. Ask your builder to turn source maps off for the production build and to stop uploading the source folder with the deploy.
✓KEY IN PAGEPASS
The only key in the bundle is the public one your site is meant to ship (anon key (public)).
✓PUBLIC FILESPASS
Bucket listing refused on 8 of 8 probed bucket names. Nothing downloadable by a stranger.
✓TABLE RULESPASS
Tables answered but handed over no rows (staff, users, shipments and 2 more). Rules are on.
✓ROUTE AUTHPASS
1 of the 8 app routes sampled sent an anonymous request to a login page. Nothing answered with data.
✓ENV IN CLIENTPASS
No config file or client-side env object with non-public values was found.
✓ADMIN ROUTESPASS
The admin addresses probed did not answer a stranger.
✓SUPABASE CONFIGPASS
Project found and the key the browser gets is the public one (role: anon). That is how it should be.
✓AUTH SETTINGSPASS
Redirect list is not a wildcard and anonymous sign-ins are off.
✓OPEN SIGNUPSPASS
Anyone may sign up, but an email has to be confirmed before the account works.
✓SECURITY HEADERSPASS
HSTS and CSP are both present on https.
CHECKED: 12. SKIPPED: nothing — all twelve ran. NOT REACHABLE: anything behind a login; the server behind the app, and your Supabase console.
SAMPLE RECEIPT. This is one of our own demo apps, and every line on it is unsealed and free to read. Nothing on this receipt is for sale.
WHAT THIS IS NOT. Twelve checks against the outside of your app in 0.39 seconds, on 20 OCT 2026.
CHECKED: 12.
SKIPPED: nothing — all twelve ran.
NOT REACHABLE: anything behind a login; the server behind the app, and your Supabase console.
A clean receipt is not a guarantee of safety, and an open line is not a break-in: it is a door left unlocked, and anyone can try the handle.
ref 57 lilac 4 tide cinder · walkaround.app
Walkaround · twelve checks, a dated receipt, and the fix to paste back into the tool that built your app.
It is not a penetration test, and it looks behind a login only when you hand it one to look with.
What it costs · status · Terms · Privacy · Refunds