Security checks

Things an AI agent can reach on your site that you may not know are visible.

• critical

  API key visible in a public script

  /config.js

  Fix: Move the key to your server and rotate the exposed one today.

• critical

  Admin route answers without a login

  /admin

  Fix: Require sign-in on every admin path and return 403 for everyone else.

• high

  Customer emails listed on a page agents can read

  /account

  Fix: Show only the signed-in person's own details.

• high

  Contact form accepts automated submissions

  /contact

  Fix: Add rate limits and a challenge for non-human traffic.

• medium

  Unlisted API route returns data

  /api/export

  Fix: Protect it with authentication or remove it.

• low

  Backup file reachable by guessing the name

  /backup.zip

  Fix: Delete it from the public folder.