Deckproof
scan my site
DE
SAMPLE REPORTThis is what you get. tidytasks.example is a made-up to-do app with the eight most common problems we find on vibe-coded sites. Every fix is shown, the way a paying customer sees it.Grade my own site
report / tidytasks.example08.09.2026 · Lovable (Supabase backend) · valid 30 days
E
49 / 100

A stranger could read your database.

8 problems1 critical4 high3 lower
FSecurity2 / 100A-01, DE-SEC-01b, C-02 +1
DEU legal information56 / 100DE-IMP-01, DE-3P-01
BQuality88 / 100Q-09, Q-15
FIRST FIX / A-01 CRITICALAnyone can read your database
ATTACKER'S-EYE REPLAY / read-only0 / 16 requests
01 / YOUR REPORT · tidytasks.example

8 problems, most important first.

Mark a problem fixed to see what the grade would be. Then re-check: the grade only counts once the scanner sees the fix on your live site.

THIS IS THE FULL REPORT
EUR 9for your own site
  • Every fix written for your builder, with text to paste
  • What a stranger could actually read from your data
  • Your own link to the report, no login, no expiry
  • Re-check as often as you like for 7 days
Grade my own siteThe grade, the three most important problems and the full fix for the most severe one are free. No account needed.
REPORT TOOLS Card image

Security

GRADE F · 2 / 100
A-01
Anyone can read your database

The Supabase table "tasks" answers to anyone who asks, without a login. Row Level Security is switched off, so the public key that ships with every Lovable site is enough to read everything in it.

WHAT A STRANGER CAN READ RIGHT NOW
1,284rows reachable with no login
iduser_idtitlenotes · personaldue_atemail · personalcreated_at

We counted the rows and read the column names from the schema. We do not read anyone’s data, not even one masked row.

GET /rest/v1/tasks?select=*&limit=0 with the public anon key -> 200, 1,284 rows readable
columns (from the published schema): id, user_id, title, notes, due_at, email, created_at
No row was read: the count comes from the Content-Range header.
HOW TO FIX · OWASP A01:2025
In Supabase open Table Editor > tasks > "RLS disabled" and enable Row Level Security. Then add one policy: "Enable read for own rows" with the expression auth.uid() = user_id. Paste this into Lovable: "Enable RLS on the tasks table and add a policy so users can only select, insert, update and delete rows where user_id = auth.uid()."
CRITICAL
DE-SEC-01b
HTTP is not redirected to HTTPS

The site still answers on plain http:// and does not send visitors to the secure version. On a café network anyone can read or change what those visitors see.

GET http://tidytasks.example/ -> 200 OK (no Location header)
HOW TO FIX · OWASP ASVS 9.1.1
Lovable: Settings > Domains > enable "Redirect HTTP to HTTPS". On Vercel and Netlify this is already the default; check your custom-domain settings if you connected one.
HIGH
C-02
Other sites can read your logged-in data

Your backend answers with "any origin may read this, including credentials". A malicious page a logged-in user visits can quietly fetch their data.

Origin: https://deckproof-cors-probe.example -> Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true
HOW TO FIX · CWE-942
Reply with your own origin only. Paste into your builder: "Set the CORS allow-origin header to https://tidytasks.example instead of * and remove allow-credentials for other origins."
HIGH
T-02
No Content-Security-Policy

Without a CSP, any script that gets injected into the page runs with full access to it.

content-security-policy: (missing)
HOW TO FIX · CWE-693
Add the header Content-Security-Policy: default-src 'self'; img-src 'self' data: https:; style-src 'self' 'unsafe-inline'; script-src 'self'. Start in report-only mode (Content-Security-Policy-Report-Only) for a day, then enforce.
MEDIUM

EU legal information

GRADE D · 56 / 100
DE-IMP-01
No Impressum found

No provider page was found at the usual addresses or in the footer. German law expects one on business sites that people in Germany can reach (§ 5 DDG). General information, not legal advice.

Checked /impressum, /imprint, /legal, /about and every footer link: none matched.
HOW TO FIX · § 5 DDG
Add a page at /impressum with your name, postal address, email and, where applicable, your VAT ID, and link it from every footer. Paste into your builder: "Add an Impressum page at /impressum with these details and link it in the footer on every page."
HIGH
DE-3P-01
Fonts loaded from Google

Two font files are loaded from fonts.googleapis.com, which sends every visitor's IP address to Google on each visit. Since a 2022 Munich court ruling this is regularly the subject of warning letters in Germany. General information, not legal advice.

<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600"> and 1 request to fonts.gstatic.com
HOW TO FIX · LG München I, 3 O 17493/20
Self-host the fonts: download the two files, put them in /public/fonts, and replace the Google link with @font-face rules. Paste into your builder: "Remove the Google Fonts link and self-host Inter from /public/fonts with @font-face."
HIGH

Quality

GRADE B · 88 / 100
Q-09
Google sees an empty page

The HTML that arrives from the server contains no text; everything appears only after JavaScript runs. Search engines and link previews get a blank page.

Server HTML: 0 words in <body>, 1 <div id="root">. After render: 412 words.
HOW TO FIX · SEO
Turn on server rendering or pre-rendering for the public pages. Paste into your builder: "Pre-render the landing page and the pricing page to static HTML so they contain their text without JavaScript."
MEDIUM
Q-15
No favicon

Browsers show a blank tab icon.

GET /favicon.ico -> 404, no <link rel="icon">
HOW TO FIX
Add a 32x32 PNG or an SVG as /favicon.ico or via <link rel="icon">. Most builders have a "favicon" field in the project settings.
LOW
Automated technical scan. EU legal items describe what was technically detected and link general legal sources; Deckproof does not assess your individual case and does not provide legal advice (keine Rechtsberatung, no Rechtsdienstleistung under the RDG). For an assessment of your case, consult a lawyer or, for data protection, a data-protection officer or your supervisory authority.