About ten minutes in total · no code to read

The five checks

Each one takes about two minutes. Run them before every launch, and again after every big change.

Open door 1 of 5

The open table

Your database has a rule on every table that says who may read it. Forget it on one table, and anyone with your app's public key can read that table, or write to it.

The check

  1. Open every table in your database dashboard, not just the main one.
  2. Each one should have security switched on, with a rule that names who can read it.
  3. Log out, then try to load your data anyway. It should fail.
Open door 2 of 5

The secret key in the app

Some keys are public by design. Secret ones can charge cards, send email as you or open your storage, and anything shipped inside the app can be pulled out by anyone who downloads it.

The check

  1. Search the built app, not just your source code, for anything that looks like a secret key.
  2. Move every secret to a server, or a function the browser can't reach.
  3. Rotate any key that ever shipped. Deleting the line doesn't take it back.
Open door 3 of 5

The bucket nobody locked

Photos, documents and uploads live in a storage bucket with its own rules. Old buckets get forgotten and stay open.

The check

  1. Open one stored file in a private browser window, without logging in. It should be blocked.
  2. Lock any bucket that lets it through.
  3. List every bucket you have, including old ones you no longer use.
Open door 4 of 5

The AI with the keys to production

AI agents don't just write code now; they run it. The risk isn't the agent. It's that the agent can reach production at all.

The check

  1. Let AI tools work on a copy of your data, never the live one.
  2. Keep a backup you have actually restored at least once.
Open door 5 of 5

The one that breaks on its own

Certificates now last at most 200 days, falling to 47 days by 2029. Miss one renewal and every visitor sees a full-page warning instead of your app.

The check

  1. Find out when your certificate expires, and whether renewal is automatic.
  2. Set an alert for 14 days before expiry.
Free

Get a free evidence report

Tell us your site's address. We run passive checks only, the same ones in our videos, and send you what we find with the evidence: timestamps, status codes, screenshots. No call, no login, no obligation.

Our inbox opens this week. Until then, message @velfoundry on Instagram with your site's address. We reply in writing.