demo/lovable-crm
74
High risk
Serious problems. Fix these this week.
A live Stripe secret key is exposed in the browser bundle and a committed .env file leaks four more keys. Fix those two first.
Score 74/100. 0 is safest and 100 is the most risk. Leaked live keys weigh most, then key files, committed .env files and vulnerable packages.
All 5 issues
critical1 secret committed in current files
A Stripe secret key is in your frontend code. Anyone who opens your site can copy it and charge cards or issue refunds on your account.
src/lib/stripe.ts line 3 (sk_live_••••••••4f2a)
- Roll the key in the Stripe dashboard now.
- Move it to a server-only env var and call Stripe from an API route.
- Remove it from git history with git filter-repo.
high.env file committed
Your .env file is in the repo, so every key in it is public to anyone who can see the code.
.env (5 values)
- git rm --cached .env
- Add .env to .gitignore
- Rotate every key that was in it.
highSupabase service role key in git history
It was deleted, but it is still in an old commit. That key bypasses all your row-level security.
commit 3e1a9c0, src/supabase.ts
- Rotate the service role key in Supabase.
- Only use the anon key in the browser.
medium4 vulnerable packages
Known security bugs in next, axios and two smaller packages.
package-lock.json
- npm audit fix
- Upgrade next to the latest patch release.
low.gitignore doesn't cover .env.local
Easy to commit by accident next time.
.gitignore
- Add .env*.local to .gitignore.