Security report for rillcod/rillcodwebsite

Scanned by Merge Risk — the free A–F security grade for AI-built apps.

Merge Risk — Security Report17 July 2026

rillcod/rillcodwebsite · branch main · 80 files scanned

Wide open

rillcod/rillcodwebsite

80 files scanned·Next.js · Supabase · React

Private key block committed in a public repo. Right now anyone reading this can too. Rotate it before you finish this sentence — the roast is free, the breach isn't.

Security score0/100

Private key block committedCritical

A Private key block appears in `.env.example`. Anyone with the repo can read it — rotate it now and move it to an untracked env var.

.env.example:64

RLS policy allows everyoneHigh

A policy in `scripts/create-prospective-students.mjs` uses `(true)` as its condition, so Row Level Security is enabled but grants access to every row for everyone. Scope the policy to the current user (e.g. `user_id = auth.uid()`).

scripts/create-prospective-students.mjs:42

RLS policy allows everyoneHigh

A policy in `scripts/migrate.mjs` uses `(true)` as its condition, so Row Level Security is enabled but grants access to every row for everyone. Scope the policy to the current user (e.g. `user_id = auth.uid()`).

scripts/migrate.mjs:36

Fix it with your AI agentEvery finding, with file and line, as a prompt for Claude Code, Codex or Cursor. It starts fixing instead of hunting — and it ends by re-scanning, so “done” is proven rather than claimed.

Is your repo leaking too?

Free, unlimited, every finding. No signup, no card, and we never store your code.

Scan my repo free