Limits
What this cannot see
The scan reads one page and the files it links to, signed out, once. Everything below is invisible from that position — not because a check is missing, but because it cannot be done from outside without breaking into something.
- 1
Whether your database rules actually hold
Supabase row level security, Firebase rules and anything equivalent are enforced on requests this scan does not make. A page can look perfect and still let any signed-in user read every other user's rows.
- 2
Whether signed-in users can reach each other's data
The most common serious bug in an AI-built app is an endpoint that checks you are signed in and forgets to check whose record you asked for. Finding it means being signed in as two people and comparing.
- 3
Anything that happens on your server
Your API routes, background jobs and webhook handlers, and the keys they use, are not downloaded by a browser — so they are not read here. Neither is any page that needs a login.
- 4
Whether a sign-in can be brute-forced
Testing that would mean actually attempting logins against your app, which is exactly the kind of thing this tool refuses to do to anybody.
All four need someone to read the code and sign in as a real user. That is a manual review, and it is what the scan is not.
The other half is on offer
The repository read on the scan page covers the first three. You add a read-only collaborator, I read the tree, and the report comes back by email. The fourth stays manual, and stays off the menu.
Projekt Studio
Passive scan · no report kept