Fix Kit unlocked
Sample report · example data

tinyledger.example

Scanned Oct 18, 2026 · 25 findings · 65 checks Example data

Hold

We found issues that should be fixed before launch.

See the list below for what to fix first.

Passing every check doesn’t guarantee your app is secure.

CHECKS PASSED Example data
40/65
Critical4
Warning21
Passed40

Your full report is emailed to you as a PDF.

SAMPLE Example site, not a real customer. tinyledger.example is a reserved .example domain.
Example Example report, sample data. This is not a real scan of a real site. It’s read-only, and locked tabs show counts only. Get early access.

Security fixes

0 of 2 applied
CriticalSecret key visible in your site’s code

This key is in the JavaScript every visitor downloads. Anyone who finds it can use it as if they were you.

File and line: shown after you verify you own the site.

paste into your builder
# prompt
My app exposes a secret API key in client-side JavaScript ([file name], line [n]). Move this key into a server-side environment variable, make the API call from a server function instead, and remove the key from all client code. Then remind me to rotate the key in the provider’s dashboard, because the old one has already been public.
WarningSome security headers are missing

Browsers have fewer defences against common attacks on your pages when these headers are absent.

paste into your builder
# prompt
Add these response headers to every page: Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and frame protection. Use the config format for my host and tell me where the file goes.

What we checked