WalkaroundLAUNCH CHECK · SAMPLE
OK TO SHIP
0
nothing open to a stranger
DESKTOP WIDTH. This sample page, photographed from outside it, with nothing clicked and nothing typed.
PHONE WIDTH, cropped to the top of the page. The checks are the lines below, run against the requests they made: a photograph is not one of the twelve, and it cannot tell you what a stranger can reach.
These two photographs are of this sample page, taken from outside it at desktop and phone width. They are on our sample receipts: they are a look at the page, not part of the check.
✓KEY IN PAGEPASS
The only key in the bundle is the public one your site is meant to ship (anon key (public)).
✓PUBLIC FILESPASS
Bucket listing refused on 8 of 8 probed bucket names. Nothing downloadable by a stranger.
✓TABLE RULESPASS
Tables answered but handed over no rows (bookings, classes). Rules are on.
✓ROUTE AUTHPASS
5 of the 8 app routes sampled sent an anonymous request to a login page. Nothing answered with data.
✓RECORDS BY IDPASS
Asking for a record by id came back empty for a stranger. There is nothing to hand over.
✓ENV IN CLIENTPASS
No config file or client-side env object with non-public values was found.
✓ADMIN ROUTESPASS
The admin addresses probed did not answer a stranger.
✓SUPABASE CONFIGPASS
Project found and the key the browser gets is the public one (role: anon). That is how it should be.
✓AUTH SETTINGSPASS
Redirect list is not a wildcard and anonymous sign-ins are off.
✓SOURCE MAPSPASS
No source map or source directory reachable (2 tried).
✓OPEN SIGNUPSPASS
Anyone may sign up, but an email has to be confirmed before the account works.
✓SECURITY HEADERSPASS
HSTS and CSP are both present on https.
NOTHING FOLDED. No line is open, so there is no evidence to unseal and nothing to buy.
A monthly rescan is how you find out early if that changes.
SAMPLE RECEIPT. This is one of our own demo apps, and every line on it is unsealed and free to read. Nothing on this receipt is for sale.
WHAT THIS IS NOT. Twelve checks against the outside of your app in 0.06 seconds, on 20 OCT 2026.
CHECKED: 12.
SKIPPED: nothing — all twelve ran.
NOT REACHABLE: anything behind a login; the server behind the app, and your Supabase console.
A clean receipt is not a guarantee of safety, and an open line is not a break-in: it is a door left unlocked, and anyone can try the handle.
ref 38 moss 2 ember quiet · walkaround.app
Walkaround · twelve checks, a dated receipt, and the fix to paste back into the tool that built your app.
It is not a penetration test, and it looks behind a login only when you hand it one to look with.
What it costs · status · Terms · Privacy · Refunds