Repo: github.com/•••/school-management-app (name hidden)
Scanned: 2026-10-15 20:50
HP 52/100 · Critical condition
Don't launch yet. Real users or data are at risk.
Critical: 2 High: 3 Medium: 2 Low/info: 3
Heal all critical + high issues → HP 93/100
HP by category
| Category | HP lost |
|---|---|
| database | -22 |
| deps | -17 |
| hygiene | -9 |
Healing plan (do these in order)
1. CRITICAL: 1 vulnerable package(s) (critical) (+8 HP)
Why it matters: These dependency versions have publicly known vulnerabilities.
Where: tinypool@1.1.1
Found by: osv-scanner
Copy-paste this into Cursor / Lovable:
These packages have known vulnerabilities: tinypool@1.1.1. Upgrade each to the nearest patched version, run `npm audit fix` where safe, and list any breaking changes I need to handle.
2. CRITICAL: Supabase tables without Row Level Security (+14 HP)
Why it matters: These tables are created without RLS enabled in your migrations. With the public anon key, anyone may read/write them.
Where: attendance_records, credit_notes, fee_reminders, fee_structure_items, grading_scale_bands, health_records, inventory_categories, inventory_items, inventory_transactions, invoice_line_items, mpesa_c2b_transactions, payments
Found by: custom
Copy-paste this into Cursor / Lovable:
Enable Row Level Security on these Supabase tables: attendance_records, credit_notes, fee_reminders, fee_structure_items, grading_scale_bands, health_records, inventory_categories, inventory_items, inventory_transactions, invoice_line_items, mpesa_c2b_transactions, payments, payroll_runs, purchase_order_items, route_stops, routes, school_days, setup_progress, student_discounts, student_enrollments, student_fee_structures, student_transport, vehicle_assignments. Write a migration that runs `alter table ... enable row level security` and adds sensible policies (users can only read/write their own rows via auth.uid()). Explain each policy.
3. HIGH: 7 vulnerable package(s) (high) (+3 HP)
Why it matters: These dependency versions have publicly known vulnerabilities.
Where: brace-expansion@1.1.18, brace-expansion@5.0.9, braces@3.0.3, js-yaml@4.3.1, source-map-js@1.2.1, vite@5.4.21, xlsx@0.18.5
Found by: osv-scanner
Copy-paste this into Cursor / Lovable:
These packages have known vulnerabilities: brace-expansion@1.1.18, brace-expansion@5.0.9, braces@3.0.3, js-yaml@4.3.1, source-map-js@1.2.1, vite@5.4.21, xlsx@0.18.5. Upgrade each to the nearest patched version, run `npm audit fix` where safe, and list any breaking changes I need to handle.
4. HIGH: RLS policy allows everyone (using (true)) (+5 HP)
Why it matters: At least one policy lets any user, even logged-out, access every row.
Where: supabase/migrations
Found by: custom
Copy-paste this into Cursor / Lovable:
Find every Supabase RLS policy using `using (true)` or `with check (true)`, and replace it with an ownership check like `auth.uid() = user_id` unless the data is truly meant to be public. List which ones you changed and why.
5. HIGH: .env file committed to the repo (+5 HP)
Why it matters: Env files usually hold secrets and should never be in git.
Where: .env
Found by: custom
Copy-paste this into Cursor / Lovable:
My .env file is committed to git. Add `.env*` (except .env.example) to .gitignore, remove it from tracking with `git rm --cached`, create a .env.example with placeholder values, and tell me which keys inside need rotating.
6. MEDIUM: 7 vulnerable package(s) (medium) (+1 HP)
Why it matters: These dependency versions have publicly known vulnerabilities.
Where: @vitest/mocker@3.2.7, dompurify@3.4.14, esbuild@0.21.5, postcss-selector-parser@6.0.10, postcss-selector-parser@6.1.4, react-router@6.30.6, vitest@3.2.7
Found by: osv-scanner
Copy-paste this into Cursor / Lovable:
These packages have known vulnerabilities: @vitest/mocker@3.2.7, dompurify@3.4.14, esbuild@0.21.5, postcss-selector-parser@6.0.10, postcss-selector-parser@6.1.4, react-router@6.30.6, vitest@3.2.7. Upgrade each to the nearest patched version, run `npm audit fix` where safe, and list any breaking changes I need to handle.
7. MEDIUM: .gitignore doesn't ignore .env (+2 HP)
Why it matters: One careless commit will publish your secrets.
Where: .gitignore
Found by: custom
Copy-paste this into Cursor / Lovable:
Update .gitignore to ignore .env, .env.local, .env.*.local and similar, while keeping .env.example tracked.
8. LOW / INFO: Supabase anon (public) key in repo (+<1 HP)
Why it matters: This is Supabase's public anon key. It's designed to ship to the browser, so it's not a leak by itself. It's only safe if Row Level Security is on for every table (see the database findings).
Where: .env:2
Found by: gitleaks
Copy-paste this into Cursor / Lovable:
My Supabase anon key is in the repo. Move it to VITE_SUPABASE_ANON_KEY in .env (listed in .env.example), and confirm RLS is enabled on every table so the public key can't read private data.
9. LOW / INFO: Supabase anon (public) key in repo (+<1 HP)
Why it matters: This is Supabase's public anon key. It's designed to ship to the browser, so it's not a leak by itself. It's only safe if Row Level Security is on for every table (see the database findings).
Where: src/integrations/supabase/client.ts:6
Found by: gitleaks
Copy-paste this into Cursor / Lovable:
My Supabase anon key is in the repo. Move it to VITE_SUPABASE_ANON_KEY in .env (listed in .env.example), and confirm RLS is enabled on every table so the public key can't read private data.
10. LOW / INFO: Hardcoded Supabase URL/anon key (not env-based) (+<1 HP)
Why it matters: Fine to be public only if Row Level Security is enabled on every table; it also makes switching environments painful.
Where: .env, index.html, src/integrations/supabase/client.ts
Found by: custom
Copy-paste this into Cursor / Lovable:
My Supabase URL and anon key are hardcoded. The anon key is OK to be public ONLY if RLS is on for every table. Move them to VITE_SUPABASE_URL / VITE_SUPABASE_ANON_KEY env vars and add them to .env.example.
Scan log
- gitleaks: 3 raw hits, 2 kept after skipping tests/fixtures
- semgrep: 0 results
- osv-scanner: 15 vulnerable packages
- custom checks: done
- build: passed ✅
VibeHP is an automated scan. It catches common launch blockers but isn't a full security audit. Your code was deleted right after this scan.
