A real security report, run on our own site.

Automated findings

7 findings from 9 files and pages, read-only.

1. medium

   No visible way to delete an account or data

   The app looks like it stores user data, but no way to delete an account/data was found. Apple and Google both require this, and privacy laws give users a right to deletion.

   Fix: Add a clear way for users to delete their account and data, and mention it in the privacy policy.

   Reviewer's note: False positive. Our site has no user accounts; the scanner saw the contact form. In a client's report, a person checks this and removes it.

2. info

   What the app is built with

   Detected: Lovable (builder), Bolt (builder), Next.js (framework).

   Reviewer's note: Partly wrong. The site is built with Next.js. Lovable and Bolt were most likely picked up because our pages talk about them. A person corrects this before the report goes out.

3. info

   Speed check could not be completed automatically

   The automated speed check didn't complete. Run it by hand and note the mobile score.

   Reviewer's note: The automatic speed test was not connected yet when this scan ran. In a client's report, a person runs it by hand.

4. good

   No secret keys found in the browser code

   Scanned 9 file(s); no secret keys found. A publishable/anon key in the browser is normal.

   Reviewer's note: Correct.

5. good

   Recommended security headers are present

   The main security headers we check for are set.

   Reviewer's note: Correct.

6. good

   Privacy policy is linked

   A privacy policy link was found. A person should read it to check it matches what the app does.

   Reviewer's note: Correct.

7. good

   Accessibility basics look OK

   Language, title, viewport and image alt text passed the quick checks. A fuller review still needs a person.

   Reviewer's note: Correct for the basics the scan covers.

What a person checks next

The checks a scanner can't do.

• Can one user see another user's data? (two-account test)

  The most common serious flaw in AI-built apps. The real test is to log in as two different users and check that user B never sees user A's records.

• Sign-up, email confirmation and password reset actually work

  A person should create an account, confirm the email, reset the password, and note any error messages that leak details.

• Judge which findings actually matter for this app

  Severity depends on what the app does. A person decides which findings are urgent and writes the summary.

• Who owns the domain, database, hosting and code?

  Can't be detected from outside. Matters if the builder raises prices or shuts down.

These are part of our Launch Readiness Audit, which comes with a fixed price for every fix. No findings, no fee: if our audit of your app or site finds nothing worth fixing, you don't pay for the audit. Try our pricing calculator for an estimate.

Questions

Whose app is this report about?

Our own website, pixelridgeweb.com. We never publish a client's report, and we only scan apps when the owner has given permission.

Why does the report include mistakes?

Automated scans get some things wrong. We left the false positives in, with a note on each, to show what the human review catches before a report reaches you.

What does the full audit add?

A person runs the checks a scanner can't: logging in as two users to test for data leaks, testing sign-up and payments, checking who owns each account, and writing a fixed price for every fix.

What does "no findings, no fee" mean?

If our paid audit of your app or site (the Launch Readiness Audit, or the hacked-site check that finds how an attacker got in) finds nothing worth fixing, you don't pay for it. A finding is a security, data or launch problem we show you with evidence and a recommended fix. The first Launch Check is always free.