Sample report

Ship-Ready diagnosis: sample

This is a sample of the report format, written for a demo app (a Lovable-style SaaS with Supabase and Stripe). It is not a client project.

Summary. The app works for a single user in preview. Before real users sign up, two high-severity items expose user data, and payments don't upgrade accounts. Recommended: two Fix orders ($298 total; the other two items are included). Buy them within 14 days of the diagnosis and we refund the $49.

HIGH Row-level security is off on the profiles table

supabase/migrations/0003_profiles.sql

What it means: Anyone with your public anon key (it's in every page load) can read every user's name, email and plan.

Fix: Enable RLS and add select/update policies scoped to auth.uid(). Fix: $149, or included in Launch pass.

HIGH service_role key is bundled into the browser

src/lib/supabase.ts, VITE_SUPABASE_SERVICE_KEY

What it means: This key bypasses every security rule. Anyone can copy it from DevTools.

Fix: Rotate the key, move privileged calls into an edge function, use the anon key client-side. Included with the item above.

MEDIUM Stripe webhook accepts unsigned events and never updates the plan

supabase/functions/stripe-webhook/index.ts

What it means: Customers pay, but their account stays on Free. Anyone could also post fake events to the endpoint.

Fix: Validate the signature with the webhook secret, handle checkout.session.completed and update the plan row. Fix: $149.

LOW Google sign-in redirects to localhost in production

src/pages/Login.tsx

What it means: Sign-in works in preview and fails on your real domain.

Fix: Use window.location.origin and add the production URL to Supabase auth settings. Fix: included in any paid fix.

If we can't fix the blocker you paid for, you get a full refund within 14 days. Buy a fix within 14 days of a diagnosis and we refund the $49. Refund policy

Buy for $49 See all plans

Secure checkout by Stripe. Refund policy