Deckproof
02 / What it looks at

Every check, in plain English.

Deckproof runs 51 checks in three areas; the 28 that decide most grades are listed here. Security and quality are graded. EU legal items are neutral technical findings with general sources, never a verdict on your site. Every ID here is the same ID you see in your report.

SECURITY16 checksCan strangers get at your data, your keys or your code? These are the problems behind the big vibe-coding breaches.
A-01
Anyone can read your database
Your Supabase table answers to anyone who asks, no login needed. That is your users' data, readable by strangers. We ask once, read-only, and report what came back. OWASP A01:2025
CRITICAL
A-04
Your Firebase database is open
Your Firebase data can be read without logging in. OWASP A01:2025
CRITICAL
S-01
Your master key is inside the page
The Supabase service key sits in your site's code. Whoever reads it owns your whole database, every lock ignored. CWE-798
CRITICAL
S-02
A secret key is in your page
We look through your site's code for keys (Stripe, OpenAI, AWS, GitHub) that should never be public. With them, someone can spend your money or read your data. CWE-798
CRITICAL
S-04
Your settings file is downloadable
The .env file, with passwords and keys, is served like any other page. CWE-538
CRITICAL
DE-SEC-01
No padlock
Not served over HTTPS, or the certificate is expired or untrusted. Fix this first, everything else waits. GDPR Art. 32
CRITICAL
S-05
Your code history is public
The .git folder is reachable, so your entire source code, past versions included, can be downloaded. CWE-538
HIGH
A-03
Personal data is publicly readable
A readable table contains fields like email, phone or password hashes. That is the kind of leak that gets reported to the authorities. CWE-359
HIGH
C-02
Other sites can read your logged-in data
A sharing setting (CORS) is wide open, so any website can ask your backend for a visitor's data while they are logged in. CWE-942
HIGH
DEP-01
Your framework version has a known hole
We recognise the framework your builder used and flag versions with published security problems. OWASP A06
HIGH
S-06
Your source code ships with the site
Source maps let anyone read your code, comments and internal links. CWE-540
MEDIUM
C-04
Your API hands out its own map
GraphQL introspection is on, so anyone can ask your API to list everything it can do. CWE-200
MEDIUM
T-02
No Content-Security-Policy
A setting that stops injected scripts. Without it a bad script can run as if it were your page. CWE-693
MEDIUM
T-01
Secure connection not enforced
Browsers are not told to always use HTTPS, so a first visit can be intercepted. CWE-319
MEDIUM
T-03
Your page can be framed
Another site can wrap your login page inside theirs and trick your users into clicking. CWE-1021
MEDIUM
T-08
Cookies without safety flags
Your cookies are missing the flags that keep them off plain connections and away from scripts. CWE-1004
MEDIUM
EU LEGAL INFORMATION7 checksDoes your site show what EU and German law expect: Impressum, privacy notice, cookie behaviour, fonts. Reported as neutral information with sources, never as legal advice.
DE-IMP-01
No Impressum found
German law expects a provider page on commercial sites (§5 DDG). We say what we found and link the rule. General information, not legal advice. §5 DDG
HIGH
DE-PRIV-01
No privacy notice found
EU law expects one (Art. 13 GDPR). We look for a linked page under the usual names. General information, not legal advice. Art. 13 DSGVO
HIGH
DE-PRIV-04
Your privacy notice does not mention services you use
We compare the outside services your site actually loads (analytics, fonts, maps) with what your privacy notice names. Art. 13 DSGVO
HIGH
DE-3P-01
Fonts loaded from Google
Every visitor's address is sent to Google on each visit; often flagged since a 2022 Munich court ruling. General information. LG München I
HIGH
DE-CK-02
Trackers run before consent
We open the site fresh, touch nothing, and record whether analytics or pixels fire before the visitor answers the cookie banner (TDDDG §25). §25 TDDDG
HIGH
DE-A11Y-01
No accessibility statement
If you sell online, German law (BFSG) expects an accessibility statement. We check whether one is linked. General information. §14 BFSG
MEDIUM
US-OPT-01
No US opt-out link
If US ad-tech is present, California law expects a "Do Not Sell / Your Privacy Choices" link. We check whether one exists. CCPA
MEDIUM
QUALITY5 checksDoes your site work for Google, phones and people with screen readers.
Q-05a
Missing page title or description
Search results and browser tabs show the bare address instead of your name. SEO
MEDIUM
Q-09
Google sees an empty page
Your site only appears after code runs in the browser, so search engines and link previews see nothing. SEO
MEDIUM
Q-10c
Images without descriptions
Screen readers and Google cannot tell what your images show. An accessibility basic (WCAG). WCAG 1.1.1
MEDIUM
Q-10a
No language set
Your page does not say which language it is in, which confuses screen readers and translators. WCAG 3.1.1
LOW
Q-07
No robots.txt
A small file that tells search engines where to look. Missing here. SEO
LOW

Run all of these on your site now, free, no signup.