//Coverage
Everything Flare.ai checks from a URL
A black-box audit across your whole deploy surface. Every finding is mapped to a CWE, categorised against the OWASP Top 10, and scored with CVSS.
Secrets & keys
- API keys in client JS (AWS, Stripe, OpenAI, GitHub, Slack, Google)CWE-798
- Live-key verification: each key probed against the provider that issued itCWE-798
- Database connection strings with embedded credentialsCWE-798
- Supabase service_role vs anon key (JWT role decoded)CWE-522
- Private keys & GCP service-account filesCWE-798
OpenAI
Anthropic
Stripe
GitHub
Slack
AWSAI blind spots
- Server Component secrets leaked to the client via props (RSC payload)CWE-200
- NEXT_PUBLIC_ vars holding real server-side secretsCWE-522
- Shadow routes like /api/debug, /api/admin and /api/seed that nothing links toCWE-489
- Access tokens passed in URL query stringsCWE-598
Next.js
React
Vite
SvelteKit
NuxtToxic combinations
- Open database + unauthenticated privileged routeCWE-284
- Confirmed-live key + the backend it unlocks, on the same pageCWE-522
- Open LLM proxy + a live model keyCWE-770
- Downloadable .env + a key verified still workingCWE-538
- Token in a URL + no Referrer-Policy to contain itCWE-598
Supabase
FirebaseOpenAIStripe
ClerkDatabases & backends
- Supabase RLS-off tables & readable rowsCWE-284
- Firebase open Realtime DB, Firestore & StorageCWE-284
- Listable public storage bucketsCWE-284
SupabaseFirebase
Postgres
MongoDB
PlanetScale
NeonAuth & routes
- API routes enumerated & probed for authCWE-306
- Unauthenticated endpoints that touch dataCWE-306
- LLM cost-drain from unauth AI-proxy endpointsCWE-770
Next.jsClerk
Auth0Supabase
WorkOS
KindeHTTP headers & transport
- CSP presence + quality (unsafe-inline, wildcards)CWE-693
- HSTS, clickjacking, MIME-sniff, Referrer-PolicyCWE-319
- Credentialed wildcard CORSCWE-942
- Cookie Secure / HttpOnly / SameSite flagsCWE-1004
- Server / X-Powered-By version disclosureCWE-200
Vercel
Cloudflare
Netlify
Fly.io
NginxExposed files
- .env / .env.production (signature-verified)CWE-538
- .git/HEAD & config, downloadable source historyCWE-527
- backup.sql & database dumpsCWE-538
GitGitHub
GitLabVercelNetlifyEmail & DNS
- SPF record present & hard-fails spoofingCWE-290
- DMARC present + policy strengthCWE-290
Cloudflare
Resend
Twilio
Postmark
MailgunDependencies
- Lockfile parsed against the OSV CVE database (flare-deep CLI)CWE-1035
npmGitHub
pnpm
Bun
YarnDeep scan (connected)
- Per-table RLS audit against your live schema (read-only connection)CWE-284
- Unrestricted write policies (USING true) on INSERT/UPDATE/DELETECWE-284
- SECURITY DEFINER functions callable by anon or authenticatedCWE-269
- Migration history: disable-RLS and allow-all policiesCWE-284
- Git-history secret scan: removed-but-recoverable secrets (flare-deep CLI)CWE-798
SupabasePostgresGitHubNeon
PrismaEvery check is read-only. Flare.ai never logs in, writes data, or sends attack payloads. Shadow-route detection issues plain GET requests to common paths; a random control path is probed first, so apps that answer 200 to everything are skipped rather than reported.
Live-key verification sends a detected credential to the provider that issued it, and nowhere else, using free identity endpoints, with no model calls and no billable usage. It tells a real leak apart from a key you already rotated. Set FLARE_DISABLE_SECRET_VERIFICATION=1 to turn it off.
The connected deep scan runs only against apps you own and connect.