Check your own app

A sample, made from our own practice app. Never from a customer’s.

The report is on white paper on purpose: it is made to be printed or saved as a PDF.

atrytone

Due-diligence reportSample

Practice shop

As of 30 Oct 2026 12:08 UTC

0 of 29basic checks proven
  • 0 Verified
  • 0 Read by a rule, not proven
  • 16 To fix
  • 0 Not current
  • 13 Not read yet
  • 0 of 29 basic checks proven, as of 30 Oct 2026 12:08 UTC
  • From the check read 30 Oct 2026 12:08 UTC.
  • Ready for real customers: 23 of 24 areas read by a rule · 23 with something to fix · 1 not checked yet.
  • The newest reading counted 50 findings: 22 serious, 20 medium, 8 small notes.
  • This report does not call the app production-ready: not every basic check is verified and current.
22 / 20 / 8serious / medium / small notes
23 of 24areas read by a rule
23areas with something to fix
29 Oct 2026our record, sealed in public that day (entry #60418)

This is a SAMPLE, made from a practice app that Atrytone puts flaws in on purpose. It is not a customer's app, and nothing in it describes one.

A dated record of what Atrytone has read of this app, and how long each reading stays current. It reads the app's code and the records Atrytone holds. It is not a security audit and not legal advice.

A line counts only when its test passed on the current version and is still in time: a rule that merely ran does not count. A try on the app expires after 30 days, a performed test after 90, and a reading of the code when a night passes without a new one.

Digest (SHA-256) 78d641b3f22d4492a52115c6a1046e2d21ae9b775986e2cbee962acd22e3dab0Version of the code read: 6e292ec

The 29 lines that must hold

0 of 29 basic checks proven, as of 30 Oct 2026 12:08 UTC. From the check read 30 Oct 2026 12:08 UTC.

Safe

  • S1One user cannot read or change another user's data.To fixRead 30 Oct 2026 12:08 UTC.Two test accounts on a copy must try every table and route we found, with nothing left out and nothing reached. Until that test has passed, the rules read the code only.
  • S2No secret key in the served site, in the code or in its history.To fixRead 30 Oct 2026 12:08 UTC.Today's code is read. The line is verified only when the site the build made and the whole history were read and neither held a key.
  • S3+S5Sign-in holds: a password floor, a limit on guesses, and signing out ends the session.To fixRead 30 Oct 2026 12:08 UTC.Nobody has tried 20 wrong passwords on a copy to see the limit hold. Today the settings and the sign-in code are read.
  • S4A reset or confirmation link survives a mail scanner and works once.Not tried yetThe link has not been replayed on a copy. Our own sign-up walk found a scanner spending a link in 37 seconds.
  • S6aThe site is https only, with a trusted certificate.Not tried yetYour host usually does this. Nothing reads your live certificate yet, so we cannot say it is on.
  • S6b+S8Browser safety headers are set, and nothing private is served (.git, .env, source maps).To fixRead 30 Oct 2026 12:08 UTC.The code's side is read. Your live site is asked only after you say yes on this page, and all four of its answers (headers, git settings, settings file, error page) must be fine.
  • S7What a stranger types cannot become code, markup or a harmful file.To fixRead 30 Oct 2026 12:08 UTC.Two visitor tests can run on a copy. An upload of the wrong size or type is not tried.
  • S10Strangers cannot run up your bill: the costliest route is limited and your provider's spending cap is set.To fixRead 30 Oct 2026 12:08 UTC.Three code patterns are read. Nothing checks a cap at the provider, and no burst of calls is tried.

Data

  • D1A backup under a day old exists outside the place it could fail, on a plan that allows it.To fixRead 30 Oct 2026 12:08 UTC.A line in a document can satisfy the code rule. Nothing proves a backup runs. Which plan the database is on is asked once, and your word is the only record.
  • D2+D3One restore was tried and timed, it repeats every month, and a failure tells you.Not performed yetNo restore has been tried for your data.

Works

  • W1The main journeys have end-to-end tests that stop a bad deploy.Not performed yetOnly generic visitor tests run. A sign-up-to-first-value test is not written for your app, and no broken journey was shown to turn it red.
  • W2A crash reaches a named person within 5 minutes.To fixRead 30 Oct 2026 12:08 UTC.Nothing watches your running app for errors yet. The code is read for an error tool, and no planted fault was mailed.
  • W3An outside check sees the site go down, and silent jobs are noticed.Not tried yetThe live-site watch is off for every app. Turning it on needs your yes.

Legal

  • L1Your privacy page names who is responsible and every company your code really calls.To fixRead 30 Oct 2026 12:08 UTC.Only companies we know by name are matched, and the page's words are not read in full. A draft, not legal advice.
  • L2Your terms are in force and say who is selling: no blank left.To fixRead 30 Oct 2026 12:08 UTC.We read that the pages exist and are linked, not what they say. Whether a blank is left on the served page is not read.
  • L3No tracking that is not essential starts before the visitor agrees.To fixRead 30 Oct 2026 12:08 UTC.A consent tool is looked for in the code. A fresh browser is not opened to count cookies and outside requests.
  • L4Export and deletion of a person's data really work within a month.To fixRead 30 Oct 2026 12:08 UTC.The routes are looked for. No test person was exported and deleted on a copy to see it work.

Money

  • M1Card details never touch your app: the payment provider hosts the checkout.To fixRead 30 Oct 2026 12:08 UTC.Providers hold the card when you use their checkout. We do not yet check that no card field posts to your app.
  • M2+M3The server decides the price, and access comes from a verified payment message, not the thank-you page.To fixRead 30 Oct 2026 12:08 UTC.Code patterns are read. A forged message and a visit to the thank-you page without paying are not tried on a copy.
  • M4The same payment message twice, or a double click, charges and grants once.To fixRead 30 Oct 2026 12:08 UTC.A missing safeguard is looked for in the code. No test payment was replayed.
  • M6One real payment was made end to end and recorded.Not performed yetOnly you can make it. We can give you the checklist. None is recorded.

Reach

  • R1Mail from your app passes SPF, DKIM and DMARC.Not tried yetYour domain's mail records are not read yet.
  • R2Sign-up and reset mail reaches an inbox within a minute.To fixRead 30 Oct 2026 12:08 UTC.The code's side of mail is read. No sign-up mail was sent and timed for your app.

Run

  • O1Deploying is one action, and going back was rehearsed.Not performed yetYour host usually rolls the code back. Nobody checked that it is on or tried it, and the database is not rolled back with it.
  • O3Your domain and certificate cannot lapse unnoticed.Not tried yetTheir expiry dates are not read yet.

Kept

  • K1+K3You own every account, can remove Atrytone, and use two-step sign-in on yours.Not performed yetBring-your-own is how it is built. Removing Atrytone and two-step sign-in are not checked for your app.
  • K4Every pass shows its moment and version and expires, and the claim that an app is ready appears only while every line is current. About our own keeping, not about this app.Not tried yetThis page does it. The front door still says the words without a dated count, so the line is not met.
  • K5A regression reaches you within a day and names the line. About our own keeping, not about this app.Not performed yetA message to you when something turns red is being built and is not on.

AI features

  • A1-A3If your app calls an AI model: its output is treated as untrusted, one user's text cannot reach another's, and no secret sits in the prompt.Not tried yetOnly cost patterns are read. Nothing checks how the model's output is used.

Shown, and not counted

The plan calls these expected or a differentiator: a gap in them is not a blocker, so they are not in the count.

Safe

  • S9Parts with a known flaw are absent, and patched within 14 days of the advisory.To fixRead 30 Oct 2026 12:08 UTC.The parts are checked. The time from an advisory to a merged fix is measured on our own app only.

Data

  • D4The database is code, with constraints and indexes, and rebuilding it equals the live one.Not tried yetThe migration files are read. Rebuilding them and comparing with the live database is done on our own app only.

Works

  • W4+W5Pages degrade kindly when a part fails, and load fast on a phone.To fixRead 30 Oct 2026 12:08 UTC.Code patterns that slow a page are read. No page was measured.

Legal

  • L5+L7+L8A breach plan is rehearsed, the app can be used by keyboard, and its licences are known.To fixRead 30 Oct 2026 12:08 UTC.Markup and package licences are read. No breach plan is checked, and the law's exemption is for counsel to decide.

Money

  • M5+M7A failed renewal behaves as promised, and your app and the provider agree on who has paid.Not performed yetNo daily comparison of the two runs.
  • M8+M9Tax, invoices and EU buyer rules are right at checkout.Not performed yetYours and a lawyer's to settle. We read none of it.

Reach

  • R4The app can be found and shared: a title, a description, a sitemap and a share picture.To fixRead 30 Oct 2026 12:08 UTC.

Run

  • O4+O5A runbook for the five bad days, a named person, and a way to reach a human.To fixRead 30 Oct 2026 12:08 UTC.A way for a visitor to reach you is looked for. There is no runbook.
  • O6The limits of your free plan are named to you.Not tried yetThe limits of the free plans your code names are quoted from the vendors' pages, and which plan you are on is asked once. Nothing reads your account, so your word is the only record.

Kept

  • K2+O8Every change traces to a reviewed pull request and a receipt you can check. About our own keeping, not about this app.Not tried yetReceipts exist for the changes we make. Nothing on this page reads them for your app.
  • K6A platform change that hits your app is found, and fixed on your yes.Not performed yetNo platform change is matched to your app yet.

The map: 24 areas

Ready for real customers: 23 of 24 areas read by a rule · 23 with something to fix · 1 not checked yet. Each tick says when and on which version it was read.

Safe

  • Data access 6 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Keys 3 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Logins 7 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Access holes 2 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Input safety 1 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Cost guard 2 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Parts 2 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Old runtimes 1 to fix on your yes. Reads the Node version your code asks for (package.json, .nvmrc, Dockerfile, build files) and the lines of Next.js, Nuxt, Express and Vite it uses, against the dates their makers publish. React and SvelteKit publish no dates to judge by. A version set only in your host's dashboard, a minimum such as >=18, and Python are not read.To fixRead 30 Oct 2026 12:08 UTC.
  • Browser protections 3 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Build robot 1 to fix on your yes. Reads the GitHub Actions files in .github/workflows and whether Dependabot or Renovate is set up. GitLab CI, CircleCI and Bitbucket Pipelines are not read, and neither is a setting made on GitHub itself.To fixRead 30 Oct 2026 12:08 UTC.

Works

  • Tests No visitor tests have run on a copy of this app yet. Whether the app is tested end to end.Not checked yet
  • Errors and uptime 1 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Backups 1 to fix on your yes. 1 note beside it. A line in a document can satisfy this rule. It does not prove that a backup runs or that a restore works.To fixRead 30 Oct 2026 12:08 UTC.
  • Speed 1 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.

Legal

  • Legal pages 1 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Personal data 1 to fix on your yes. Only the companies the code names and this check knows are matched to your privacy page; your host and dashboard settings are not read, nor is any app outside JavaScript and TypeScript. This is not legal advice.To fixRead 30 Oct 2026 12:08 UTC.
  • Accessibility 1 to fix on your yes. Colour contrast and touch-target size need the live page and are not read. The EU Accessibility Act does not reach a business with under 10 persons and EUR 2 million or less (Art 3(23), 4(5)).To fixRead 30 Oct 2026 12:08 UTC.
  • Open-source licences 1 to fix on your yes. Only package-lock.json carries licences: an app that uses yarn.lock, pnpm-lock.yaml or bun.lock is not read for them. This is not legal advice.To fixRead 30 Oct 2026 12:08 UTC.

Money

  • Payments 1 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.

Reach

  • Email 1 to fix on your yes The code's side only; your domain's mail records (SPF, DKIM, DMARC) are not read.To fixRead 30 Oct 2026 12:08 UTC.
  • Search and launch 1 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.
  • Marketing 1 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.

Run

  • Staging and deploys 7 to fix on your yes. 1 note beside it.To fixRead 30 Oct 2026 12:08 UTC.
  • Support 2 to fix on your yesTo fixRead 30 Oct 2026 12:08 UTC.

What was found

50 findings counted: 42 to fix, 0 waiting for a maker's fix, 8 small notes. Every sentence about a finding is the check's own, written by a rule. The report adds no opinion of its own.

Serious 22

  • KeysA private key is written in your code.To fix
  • KeysA Stripe secret key is written in your code.To fix
  • KeysA private key file is kept with your code.To fix
  • Data accessYour code lets strangers see and change your app's data.To fix
  • Data accessYour code lets anyone run a database function that has more power than the person calling it.To fix
  • Access holesYour code lets strangers read other customers' orders by changing an id.To fix
  • Input safetyYour code lets a stranger read or delete your whole database by typing into a form.To fix
  • Data accessYour code lets strangers change all of your customers.To fix
  • Data accessYour code lets strangers see and change all of your orders.To fix
  • Data accessYour code lets strangers see rows your row security was meant to hide, through "customer_directory".To fix
  • LoginsAnyone can make a token that your server takes for a signed-in person.To fix
  • LoginsAnyone who can read your database can read every customer's password.To fix
  • LoginsIf your database ever leaks, your customers' passwords are cracked almost at once.To fix
  • LoginsYour database's master key is set up to be sent to every visitor.To fix
  • Cost guardAnyone who opens your site can copy your OpenAI key and spend your credit.To fix
  • Cost guardAnyone on the internet can make your app spend your AI credit.To fix
  • PaymentsSomeone could mark an order paid without paying.To fix
  • Staging and deploysA secret sits in your automatic-build file, where everyone who can see your code can read it.To fix
  • Build robotAnyone who opens a pull request can make your build run their code with your secrets.To fix
  • PartsYour app is built on a part with 5 published security flaws.To fix
  • PartsYour app is built on a part with 6 published security flaws.To fix
  • Browser protectionsAnother website can be allowed to read answers that were meant for a signed-in visitor of yours.To fix

Medium 20

  • Access holesYour code lets anyone with an account see everyone's invoices, not only their own.To fix
  • Data accessYour code lets anyone with a file's address download it from "receipts".To fix
  • LoginsA stranger can try passwords as fast as your server answers.To fix
  • LoginsAnyone can sign up with an e-mail they do not own.To fix
  • Legal pagesYour app starts tracking visitors with Google Analytics before they can say no.To fix
  • Errors and uptimeWhen your app crashes for a customer, nobody tells you.To fix
  • Search and launchYour browser tab and your Google result say "Vite + React", not the name of your app.To fix
  • SpeedYour pages load slowly because the app asks the database one question for every row.To fix
  • Staging and deploysOnce this migration runs, data that exists today is gone for good, and nothing in your code can bring it back.To fix
  • Staging and deploysA broken change can reach your visitors, because nothing checks the app before it goes live.To fix
  • SupportA visitor who forgets a password is locked out: nothing in the app sends a reset.To fix
  • Staging and deploysA project built from your migrations would answer your app's requests for customers with "permission denied".To fix
  • Staging and deploysA project built from your migrations would answer your app's requests for invoices with "permission denied".To fix
  • EmailMail from your app can land in spam or stop arriving, because it leaves through an ordinary personal mailbox.To fix
  • BackupsIf the database is lost or damaged, there may be no copy to bring it back from.To fix
  • AccessibilityPeople who use a screen reader are told nothing about a picture on the page, because it has no alt text.To fix
  • Open-source licencesA part your app is built on is under a network copyleft licence (AGPL), which may require you to offer the source of your whole app to everyone who uses it over the internet.To fix
  • Old runtimesYour app is built on a version of Node that no longer gets security fixes.To fix
  • Browser protectionsA browser is never told to protect your visitors here: a script slipped into a page would run unchecked; a visitor on public wifi could be moved to a fake plain-http copy of your site; a file a visitor uploaded could be run as a script; another site could show your pages hidden inside its own page, under a button.To fix
  • Personal dataYour server writes whole user records or requests into its logs, where anyone who can read the logs can read them.To fix

Small note 8

  • LoginsA stolen sign-in keeps working for days.Note
  • Staging and deploysSupabase's Free plan pauses a project after a week with little use. Which plan is this app on?Note
  • SupportA visitor with a problem has nowhere to turn: the app shows no contact address, contact page or help chat.Note
  • Staging and deploysA project built from your migrations would answer your app's requests for customer_directory with "permission denied".Note
  • Staging and deploysA project built from your migrations would answer your app's requests for orders with "permission denied".Note
  • MarketingPeople who use the app cannot see what changed, because the app has no page for what is new.Note
  • BackupsSupabase's Free plan has no automatic backups. Which plan is this app on?Note
  • Browser protectionsIf the other site is ever hacked, its changed script would run on your pages, with your visitors' logins.Note

What was not read

  • Your running site. We read your code, not the live site, so a setting made in a host's dashboard is not seen.
  • Email. The code's side only; your domain's mail records (SPF, DKIM, DMARC) are not read.
  • Backups and restores. We look for a backup in your code. None is run, and no restore is tried.
  • Measured speed. No page is timed. The rules read your code for what makes pages slow.
  • Payments beyond the code. We read your payment code. No payment is made, test or real.
  • Other databases. Data rules are read for Supabase and Firestore. Any other database is not.
  • Your git history. We read your code as it stands now, so a key deleted but still in the history is not seen.
  • Colour contrast. It needs the live page, so it is not read.

A clean reading says the rules found nothing. It is not a promise that nothing is wrong.

The reading's own could-not-check lines

  • marketing front page: the call to action was not read the front page (index.html) is drawn by components, script, a redirect or a link this check cannot read in full, so whether it offers a next step was not judged
  • outside scripts: 1 script loads from an address that names no version a file that can change under the same address (www.googletagmanager.com) cannot have a fixed fingerprint, so none was asked for
  • privacy: the words of the privacy page are not in its file src/pages/Privacy.jsx holds little running text of its own, or loads its words from a translation, a Markdown file or a content service, so whether it names the 3 companies in the code was not read

Sources of this report that could not be read

  • The sample is made in memory: no pictures, no probe and no drill ran on it.

Where a free plan stops being enough

Platforms read: Supabase, Lovable, Bolt, Replit, Vercel, Render. Each trap below is a sentence from the vendor's own page, read 29 Oct 2026 12:25 UTC.

Supabase The owner has not said which plan.

  • Supabase's Free plan pauses a project after a week with little use. A paused project is switched off until someone restores it in the Supabase dashboard, so your app shows errors after a quiet week.Supabase pauses Free Plan projects that show low activity over a 7-day period to save server resources.Project Pausing | Supabase Docs
    Read 29 Oct 2026 12:25 UTC
  • Supabase's Free plan has no automatic backups. If the database is lost or damaged, there is no copy of its rows to go back to unless you made one yourself.Automatic backups Not included in freePricing & Fees | Supabase
    Read 29 Oct 2026 12:25 UTC

Where each number comes from

  • The code. From the check read 30 Oct 2026 12:08 UTC on version 6e292ec. Repository drill-shop (planted in memory). 29 files read, rules version 2026-10-29g.
  • Visitor tests on a copy. No visitor tests on a copy of this app were found, so the Tests area reads nothing.
  • Probes and drills. No probe or drill result is held for this app, so no table-stakes line can be verified from one.
  • The owner's word on plans. The owner has given no word on a platform plan.

The ledger, and this report's digest

The ledger's head was last published on 2026-10-29, at row 60418 (hash 556ae13870d4…), after 60418 rows were verified, in a public file of Atrytone's own repository. The ledger row of the reading this report counts was not carried, so the report does not say whether that head covers it.

The digest below is the SHA-256 of this report's content. When the owner shares the report, the frozen copy is written to the ledger as one row, and the daily published head covers that row like any other. A printout whose digest differs from the shared copy was made from a different report.

78d641b3f22d4492a52115c6a1046e2d21ae9b775986e2cbee962acd22e3dab0

Every sentence about a finding is the check's own, written by a rule. The report adds no opinion of its own.

Check a receipt