Sample scan report
We scanned an app built with AI. Here's what we found.
From a leaked API key to an admin page anyone can open: each issue explained in plain English, with a fix prompt you can paste into your AI coding tool. Apps built this way often ship the same mistakes. See what's in yours.
sample-saas-appNeeds review
Start here · Critical 2
High 2
Medium 1
Low 1
Critical Secrets
Issue 1 of 6secrets · no-hardcoded-secrets
OpenAI API key committed in .env
.env · line 3
What's wrong
Your OpenAI key is sitting in .env at the root of this repo, and .env is committed to git.
Why it matters
Anyone who can see the repo can spend against your OpenAI account. Deleting the file is not enough on its own: the key stays visible in your git history, so treat it as already exposed and rotate it.
How to fix it
Untrack .env, scrub it from git history, keep the real key out of the repo, and rotate it. About ten minutes.
My repo has an OpenAI API key committed in .env at the project root, and .env is tracked by git.
1. Add .env to .gitignore and untrack it.
2. Scrub the file from git history with a tool like git filter-repo, warning me first that this rewrites history and needs a coordinated force push.
3. Add a .env.example with a placeholder and confirm the code reads the key from process.env, so the real value lives only in my untracked local .env and in my host's environment settings.
4. Remind me to rotate the key in the OpenAI dashboard when done.
Explain each step before you make changes.