- your-app/built in a weekend
- src/config.ts12 live API keys, public
- src/api/no auth on any endpoint
- migrations/never run · 4 tables drifted
- .envcommitted to the repo
Audit & triage
A full scan ranks findings by what an attacker would try first.
Stop the bleeding
Keys are rotated and moved server side, with access control added on every endpoint.
Untangle
Schema is reconciled and a migration pipeline added so it can't drift again.
Handed back, production ready
Twelve findings are patched and verified, documented for whoever comes next.