lovable-todo

Clerk auth wired through middleware

What we check · Looks for an auth provider (Clerk, NextAuth, Auth0, WorkOS, Convex Auth), detects MD5/SHA1 password hashing, and flags hand-rolled session cookies.

Route handlers gated; no admin routes exposed

What we check · Verifies admin routes have auth checks, looks for role-based gating, and checks whether schema-declared tenant IDs are enforced in query code.

Schema looks clean; no obvious PII exposure

What we check · Detects the database layer, looks for a migrations directory, flags PII/regulated columns (HIPAA/PCI signals), and warns on sequential integer IDs.

6 vendors detected; all in the registered directory

What we check · Maps external service dependencies and integration health. Reserved for upcoming checks on third-party SLA coverage.

Dockerfile, CI, and lockfile all present

What we check · Checks for deployment config (Dockerfile, Terraform, Vercel, Fly, Railway, K8s), a CI workflow, a lockfile, and a .env.example.

LICENSE present; no regulated-data signals

What we check · Reads the LICENSE (AGPL/GPL blocks commercial reuse), detects HIPAA/PCI signals in code, and checks for a consent mechanism when regulated data is present.

1 finding