live.scan
[00:00] cloning repo → github.com/acme/todo-app
[00:01] scanning 47 files...
[00:02] rule:exposed-api-key ── FAIL (critical)
└─ src/pages/api/chat.ts:12
const key = "sk-proj-8f3c...";
[00:02] rule:missing-rls ── FAIL (critical)
└─ lib/supabase.ts uses service_role client-side
[00:03] rule:permissive-cors ── FAIL (high)
└─ next.config.ts → "*"
[00:03] rule:dangerously-set-inner-html ── OK
[00:03] rule:sql-injection ── OK
[00:04] analysis complete → 3 issues
[00:04] badge: ❌ (resolve 2 critical to pass)