Production Readiness Report
Scanned October 2, 2026 at 1:12 AM·Next.js
Launch readiness
Fix high-priority issues before launch
Report confidence
High
No major externally observable production issues were detected within the completed checks.
2 high-priority findings worth reviewing.
An engineer can review the findings with you and prioritize what actually matters.
Your application scored 90/100 and falls into the Strong range — a measure of production readiness within the scope of this external audit, not a security guarantee.
No confirmed critical issue was detected, but 2 high-priority findings should be reviewed before you increase traffic. The most important issue relates to content security policy is not configured.
This external audit cannot verify backend authorization, database permissions, or server-side secrets, so a code-level audit would provide additional confidence.
7 of 7 findings
What we observed
No Content-Security-Policy header was returned on the 4 pages included in this scan.
Why this matters
A well-configured CSP reduces the impact of certain browser-based injection attacks.
Affected pages: 3
Recommended action
Introduce a CSP gradually — start in report-only mode, then tune it to your app's real resources before enforcing.
What we observed
An error response appears to include a framework stack trace.
Why this matters
Stack traces reveal file paths and dependencies — reconnaissance material for targeted attacks.
Recommended action
Enable production error handling so users see a generic page and details go to your logs.
What we observed
2 JavaScript source maps were reachable at public URLs.
Why this matters
Source maps make it easier to read your minified code. A disclosure concern, not a direct compromise.
Recommended action
Disable source-map output for production builds, or restrict access at the hosting layer.
What we observed
While loading the scanned pages, 3 sub-resource requests returned 404.
Why this matters
Broken resources degrade the UI and can indicate stale references left from rapid iteration.
Evidence
| 404 | /images/hero-v2.png |
| 404 | /api/legacy/config |
Recommended action
Review the failing requests and remove or fix the references.
What we observed
No Referrer-Policy header was returned on the scanned pages.
Why this matters
Full URLs (which can contain identifiers) may be sent to third-party sites users navigate to.
Recommended action
Add Referrer-Policy: strict-origin-when-cross-origin.
What we observed
Detected integrations: Stripe, Supabase, Google Analytics, Sentry.
Why this matters
Not a problem by itself — this is your external dependency surface.
Evidence
| payments | Stripe |
| backend | Supabase |
Recommended action
Review the list and remove any service you no longer use.
What we observed
Auth provider(s): Supabase.
Why this matters
Whether authorization and session handling are correct can't be confirmed externally.
Recommended action
Have authentication and authorization logic reviewed at the code level.
Because this application uses Stripe, Supabase, Google Analytics and backend services, a code-level review can verify authorization rules, database access, secrets handling, and server-side validation.
The code audit can inspect
We'll review your findings, understand what's blocking you, and tell you what we recommend fixing first.
This audit evaluates externally observable production behavior only. It does not attempt to exploit, bypass, or gain unauthorized access, and cannot see server-side code, private data, or infrastructure. Findings marked “Strong signal” or “Requires verification” should be reviewed before being treated as confirmed. Anything resembling a secret is stored and displayed in redacted form only. A clean external scan does not guarantee the application is free of vulnerabilities.
Retained until November 1, 2026. Scoring v1.0 · Scanner v1.0 · Report v1.0