THE CHECKLIST$0
Your first five checks.
A small, useful place to start.
- 5 common security holes
- A 5-minute test for each
- 3-page PDF, yours to keep
- No email address needed
// BUILT WITH AI. CHECKED BY YOU.
Your AI built
the app.
Who checked
the locks?
Five common security holes.
A 5-minute test for each. Free.
3-page PDF. No email. Yours to keep.
Want to go further? See the scannerIT WORKS. BUT IS IT SAFE?
YOUR VERY REAL APPFIG. 01
build me a SaaS
LOOKS FINE ≠ LOCKED DOWN
CHECK THE DOORS BEFORE YOU OPEN THEM.
A working app is the beginning.
Let's check the parts you can't see.
MADE FOR APPS BUILT WITH
Cursor · Claude Code · Lovable · Bolt · v0 · Replit
01 / THE BLIND SPOTIt works on
It works on
your machine.
That's the problem.
Security holes can hide when you're the only user testing your app. Attackers don't test it like you do.
SOUND FAMILIAR?
- “I only ever log in as myself, so I never saw other people's data.”
- “The key was in the frontend because that's where the AI put it.”
- “I didn't know Server Actions were public URLs.”
THE FIRST DOOR / FREE
5 holes.
5 minutes each.
Check yours tonight.
- 01Secret keys in the browser
- 02Your database has no locks
- 03Logged in ≠ allowed
- 08Denial of wallet
- 11Packages that shouldn't exist
Direct download. No signup, no detour.
YOURS.ACTUALLY FREE.
The checklist tells you
what to look for.
The kit helps you find it.
Run one command. See the suspects, the file and line, and the guide page that explains the fix.
SHIP SAFE SCANNER / V2.0
node ship-safe-scan.mjs . --url https://my-app.com
CRITICAL
Secret-looking variable is public
NEXT_PUBLIC_OPENAI_API_KEY · app/page.tsx:3
NEXT_PUBLIC_OPENAI_API_KEY · app/page.tsx:3
CRITICAL
Webhook has no visible signature check
app/api/webhooks/stripe/route.ts
app/api/webhooks/stripe/route.ts
HIGH
Server action has no visible auth check
app/profile/actions.ts
app/profile/actions.ts
HIGH
Table “notes” created without enabling RLS
supabase/migrations/001_init.sql
supabase/migrations/001_init.sql
HIGH
HTML rendered without a visible sanitiser
components/Bio.tsx:1
components/Bio.tsx:1
LOCAL CODE. USEFUL CLUES. YOUR NEXT STEP.↗
Illustrative 38 → 96 walkthrough; scores vary by project. A clean scan is a starting point, never proof of security.
THE SECOND DOOR / THE $19 KIT
Everything in the free checklist.
Plus the tools to close the holes.
Get the kit · $19
One payment. Yours to use in your own and client projects.
01 / THE SCANNERIN THE KIT
Scan your code. Check your live site. Know where to start.
ACTUAL PAGES. NO MOCKUPS.
A look inside.
What it is. How to test it. How to fix it.
Scroll the pages. Tap to read.
Start with a sheet.
Leave with a plan.
THE COMPLETE KIT
$19one-time
The tools to go further.
Everything in Free, plus:
- Local code + live-site scanner
- 15 holes, 43-page field guide
- 16 copy-paste audit and fix prompts
- Supabase audit SQL + reference code
- Security rules for 6 AI tools
- Screen + print editions, lifetime updates
Not sure? Take the free checklist.
If you fail one test, you'll know whether you need the rest.
For people
who ship things.
You don't need a security background.
You do need an app you're willing to check.
Want hands-on help instead? See the audits
✓ This is for you if
- You built, or are building, an app with AI.
- You handle user data, payments, uploads or AI APIs.
- You'd rather check the locks before launch.
× Look elsewhere if
- You need a SOC 2, HIPAA or PCI certificate.
- You need a professional penetration test.
- You expect a scanner to prove an app is secure.
“I make animated security explainers as @stackdrawn. This kit is everything I check before I'd let a friend launch.”
STACK, DRAWN ↗BUILT FOR REAL APPS.
Fair questions.
I'm not a developer. Will I understand it?
If you've shipped with an AI tool, you can start here. The guide uses plain language and gives you browser tests, commands and SQL queries to follow. Some fixes need your AI coding tool and a little patience.
My stack isn't Next.js or Supabase.
The security principles apply across stacks. The scanner works best with JavaScript and TypeScript projects; the reference code focuses on Next.js, Supabase and Stripe. Use the fix prompts to adapt the guidance to your stack.
Does the scanner upload my code?
No. Code scanning runs on your machine. Unless you use --offline, it can look up dependency names on npm. If you provide --url, it sends checks to that live site. Only test apps you own or have written permission to test.
Is a clean scan proof my app is secure?
No. The scanner flags common patterns for you to investigate. Ownership checks, UI-only permissions and prompt injection need the manual tests in the guide. No scanner score replaces a professional security assessment.
What do I need to run it?
Node.js 18 or newer and access to your project files. The scanner is one file with no dependencies to install. The field guide and checklists are PDFs; the Supabase audit runs in your Supabase SQL editor.
Can you check my app for me?
Yes, by application. A Security Audit ($500) gets you a hand-tested review of all 15 holes with a written report. With Audit + Fix ($2,500), I fix the critical and high findings too. See how audits work.
What about refunds and updates?
You have 14 days to request a refund, no questions asked. Updates to this kit are free for life through the same Gumroad download link. Contact the seller through your Gumroad receipt for purchase help.
Can I use it on client projects?
Yes. One purchase covers one developer and allows use in personal, commercial and client projects. You can adapt the code and prompts for those projects. You can't redistribute or resell the kit itself.
BUILD SOMETHING GOOD. CHECK THE LOCKS.