Sample Report — myapp/backend

Weekly Founder Report

Week of June 9–16, 2025

92
/100
Your app is healthy.
Mostly Alive — up 7 points from last week.
3 things fixed. 3 things to watch. One of them takes 15 minutes.

Shepherd found and would have fixed

  • ✓
    Fixed auth middleware — session tokens not expiring
    Tokens were being issued with no expiry. Any stolen token worked forever. Fixed.
  • ✓
    Patched lodash (CVE-2024-1234) — prototype pollution
    Updated to 4.17.21. The version you had let attackers modify Object.prototype.
  • ✓
    Reduced /api/users latency by 14% via response caching
    Added stale-while-revalidate cache headers. Your users noticed.

Action needed

  • Add rate limiting to /api/auth/login (15 min)
    No rate limit on login means someone can try 10,000 passwords. Quietly. All night.
    → npm install @upstash/ratelimit — full setup in the docs. Seriously, 15 minutes.
  • Supabase anon key in client bundle — verify RLS (5 min check)
    The anon key being public is fine. Your tables being public is not.
    → In Supabase: Database → Tables → enable RLS → add 'users can read their own rows' policy.
  • 3 TODO comments in /lib/payments.ts (Varies)
    TODO: actually do the TODO. It's been 6 months.
    → grep -r 'TODO' lib/ to see them all. File GitHub issues for any that aren't trivial.
TL;DR:Add rate limiting (15 min effort) and you'll hit a perfect score next week. The sheep are rooting for you.

Get this for your actual app

Free scan. No account. Paste a repo URL and get your score in 10 seconds.

Scan my app →