Every check Heimdall runs, explained.

Exposed API keys and secrets in your code

An exposed API key is any credential, like a Stripe secret key, an OpenAI token, or a database password, that ends up committed to your source code instead of staying in an environment variable. It is the single most common security mistake in vibe-coded projects, and also the most expensive one.

Committed .env files and missing .gitignore rules

Your .env file usually holds every password, database URL, and API key your app needs. Committing it to GitHub, even briefly, exposes all of those at once. This check looks for an exposed .env in your repo and verifies that your .gitignore actively protects future ones.

Plain text and weakly hashed passwords

If your app stores passwords directly, those passwords have to be hashed with a slow, salted algorithm before they touch the database. MD5 and SHA1 do not count. Plain text definitely does not count.

Passwords and tokens written to your server logs

Credential logging is when sensitive values, like a password, an API token, or a full user record, get printed to your server logs, usually by accident, through a debug console.log left in the code.

CORS wildcard origins and request security

CORS controls which websites are allowed to call your API from a browser. If your server returns Access-Control-Allow-Origin: *, any site on the internet can send authenticated requests to your endpoints. That is almost never what you actually want.

Missing HTTPS redirects and HSTS headers

Getting an HTTPS certificate is now a default on hosts like Vercel and Netlify. Forcing every visitor onto HTTPS, and telling browsers to refuse the plain HTTP version on future visits, is a separate step that often gets skipped.

Broken access control and IDOR vulnerabilities

Broken access control, often called IDOR (insecure direct object reference), is the single most exploited class of web vulnerability today. It happens when an API route accepts a resource ID from the request and acts on it without checking that the requesting user owns the resource.

Missing rate limiting on sensitive API routes

Rate limiting controls how often a single user, IP, or API key can hit a route. It is the difference between a single failed login attempt and ten thousand per second. Without it, the cheapest attack on your app is also the most damaging.

Sensitive routes without authentication checks

Authentication and authorization are two different things. Auth checks that a user is logged in. Authorization checks that the logged-in user is allowed to do this specific action. This check covers the first one: any sensitive route that is reachable without being logged in at all.

Missing row-level security on your Supabase or Firebase database

Row-level security (RLS) is a set of rules on your database that decide which rows a given request is allowed to touch. Supabase and Firebase both ship with RLS off or wide open by default, which means the client-side key your app already exposes to the browser can query the entire table unless you lock it down.

Admin pages and APIs that don't check for an actual admin

Admin privilege escalation happens when an admin-only page or API route checks that a user is logged in, but never confirms they're actually an admin. Any signed-up user who finds the URL or the API endpoint gets full admin access.

Weak session token and cookie configuration

If your app rolled its own authentication instead of using Supabase Auth or Clerk, the security of every logged-in session comes down to how the session token is created and stored. A few common mistakes here can let an attacker forge a session or steal one from a legitimate user.

Leftover test, seed, and debug API routes in production

Debug endpoints are API routes built for local development or testing, like seeding the database or sending a test email, that get committed and deployed alongside the real app without anyone deciding they should be public.

Unvalidated API input on write routes

Every API route that accepts data needs to know exactly what shape that data should take, and reject anything that does not match. Without that check, attackers can send extra fields, wrong types, or oversized payloads that the route was never designed to handle.

Cross-site scripting (XSS) from unsanitized user content

Cross-site scripting happens when your app takes text a user typed, like a comment, bio, or product review, and renders it as live HTML instead of plain text. If an attacker's input contains a script tag, it runs in every other visitor's browser as if it were your own code.

SQL injection from string-built database queries

SQL injection happens when a database query is built by inserting user input directly into a string of SQL text, instead of passing it as a separate parameter. A crafted input can change what the query actually does.

Server-side requests and redirects to a user-supplied URL

This check covers two related mistakes: your server fetching a URL that a user provided (server-side request forgery, or SSRF), and your app redirecting to a URL a user provided without checking where it points (open redirect).

Stripe webhook signature verification

Stripe webhooks are how your app learns that a payment succeeded, a subscription was canceled, or a refund went through. If the endpoint does not verify the signature on incoming requests, anyone can fake those events and unlock paid features without paying.

Hardcoded localhost and development URLs in your code

This check looks for web addresses, most often localhost or a local dev server port, written directly into your source code instead of read from an environment variable or config setting.

Missing or outdated .env.example file

A .env.example file lists every environment variable your app expects, with placeholder values instead of real ones. It's how anyone, including your future self or your AI coding assistant, knows what to configure to run the project.

Missing or incomplete privacy policy

A privacy policy explains what data your app collects, how you use it, and how users can see or delete it. It is not optional for any app that takes signups, uses analytics, or accepts payments.

Missing terms of service or user agreement

A terms of service document, sometimes called a user agreement or terms of use, is the contract between your app and its users. It defines what they can do, what you owe them, and what happens when something breaks.

Missing cookie consent banner for GDPR

GDPR requires explicit consent before setting non-essential cookies (analytics, advertising, A/B testing) for users in the EU. A cookie banner is the standard way to capture that consent, and most analytics and ad platforms will refuse to fire without one.

Missing error monitoring in production

Error monitoring captures unhandled exceptions, failed requests, and slow performance in production and routes them to a dashboard you can actually look at. Without it, the first time you hear about a bug is from a user, and only if they bother to email.

Missing product analytics

Product analytics tracks what users actually do inside your app. Which buttons they click, which pages they spend time on, where they bail. Without it, every product decision is a guess.

Missing database indexes on common lookup fields

An index is a precomputed lookup table that lets the database find rows by a specific column in milliseconds instead of scanning the whole table. Forgetting one is invisible at 10 users and crippling at 10,000.

N+1 database queries running inside a loop

An N+1 query happens when your code fetches a list of items with one query, then runs a separate query for each item in that list to get related data, instead of fetching everything in one go.

Database reads with no row limit

An unbounded query is a database read with no limit on how many rows it can return. It just pulls everything that matches the filter, however many rows that turns out to be.

Large, uncompressed images slowing down your pages

Unoptimized images are large image files, often straight out of a camera or a design tool, committed to your project without being resized or compressed for the web.

Missing SEO and social sharing basics

Even a great product is hard to find without the basics of search engine and social media metadata. A missing sitemap keeps you out of Google. A missing OG image makes every shared link look broken.