Sample Launch Check report

From our deliberately broken demo app. Live scans write fresh reports under /reports/….

NO-GO

Score 38/100

13 critical · 10 high · 12 medium · 16 low

CRITICAL

Exposed /.env + OpenAI / Stripe / AWS / Supabase service_role keys

CRITICAL

Missing RLS — account A can read account B's todos

CRITICAL

Firestore messages publicly readable

HIGH

Broken nav links, uncaught TypeError, failed /api/stats

Each finding includes evidence, a plain-English fix, and a copy-paste prompt for Cursor / Lovable / Bolt.