Impact:This could mean RLS is correctly filtering all rows for anonymous requests (a good outcome that looks identical over the wire to a genuinely empty table), or it could mean the table is simply empty right now and would return real data once populated. This scan cannot distinguish the two cases from the response alone.

Impact:This could mean RLS is correctly filtering all rows for anonymous requests (a good outcome that looks identical over the wire to a genuinely empty table), or it could mean the table is simply empty right now and would return real data once populated. This scan cannot distinguish the two cases from the response alone.

Impact:This could mean RLS is correctly filtering all rows for anonymous requests (a good outcome that looks identical over the wire to a genuinely empty table), or it could mean the table is simply empty right now and would return real data once populated. This scan cannot distinguish the two cases from the response alone.

Impact:This could mean RLS is correctly filtering all rows for anonymous requests (a good outcome that looks identical over the wire to a genuinely empty table), or it could mean the table is simply empty right now and would return real data once populated. This scan cannot distinguish the two cases from the response alone.

Impact:This could mean RLS is correctly filtering all rows for anonymous requests (a good outcome that looks identical over the wire to a genuinely empty table), or it could mean the table is simply empty right now and would return real data once populated. This scan cannot distinguish the two cases from the response alone.

Impact:A Supabase Anon/Publishable Key is visible in the HTML source. This is expected — this key is designed to be public and is safe to ship client-side by itself. It becomes a real risk only if the server-side authorization behind it (RLS policies, webhook signature checks, security rules) is missing or misconfigured — see the relevant findings below for that check.

Evidence:eyJhbGci***GJD0

Impact:This endpoint allows cross-origin requests from any website, but does not accept credentials (cookies/auth headers), so this is the expected configuration for a public API. Only a concern if this endpoint later starts returning user-specific or authenticated data without also restricting the origin.

Evidence:OPTIONS https://www.bullwiser.com/ → Access-Control-Allow-Origin: *

Impact:This token decodes to role: "anon" with a multi-year lifetime, matching Supabase's publishable API key exactly — it's meant to be public and long-lived, and grants no access on its own. Every table it can reach is gated by that table's own Row Level Security policy, not by this key's expiry. A long lifetime here is not a vulnerability. If RLS is missing or misconfigured on a table, that shows up as its own separate finding.

Impact:This scan decoded JWT header/payload structure only — it never attempted to verify, forge, or brute-force the token's signature (e.g. testing for a weak/guessable HS256 secret), since that would require sending forged tokens to live authenticated endpoints. A finding-free result above means no structural weaknesses were found, not that the signing key is confirmed strong.

Impact:No endpoints matching a REST-style object ID pattern (e.g. /api/orders/123) were found in the page HTML or loaded JavaScript bundles. This does not mean none exist — endpoints only called after user interaction, or referenced in code not loaded on the homepage, would not be visible to this scan.

Impact:An unauthenticated request to this table was rejected (HTTP 401), consistent with Row Level Security correctly denying anonymous access.

Impact:This scan only tested unauthenticated SELECT (read) access. Testing unauthenticated INSERT, UPDATE, and DELETE was not performed because doing so safely requires a self-cleaning canary-row strategy that has not been implemented yet — attempting it without one risks writing real data into your database, which this scanner will not do.

Impact:No endpoint paths matching common proxy/fetch/preview/screenshot/webhook naming patterns were found in the page HTML or loaded JavaScript bundles. This does not rule out SSRF — endpoints only reachable after login, or referenced in code not loaded on the homepage, are not visible to this scan.

Impact:This scan only checked whether an invalid signature is rejected. It did not test replay attacks (resubmitting a previously valid, captured signed event) or idempotency handling (the same valid event processed twice) — both require a real, previously-captured valid signature this scanner doesn't have.

Impact:Without COOP, other windows/tabs opened by your page (or that open your page) can retain a JavaScript reference to it, enabling cross-window side-channel attacks such as Spectre-style data leaks.

Impact:Without CORP, other sites can embed your images/scripts/assets directly, which can enable data-leak techniques against browsers that support speculative side-channel attacks.

Impact:A DKIM selector was found at this domain, indicating outbound mail is likely being signed. Full validation of signature correctness requires an actual signed message and is outside passive DNS scanning.

Impact:No DS record was found for this domain. Without DNSSEC, DNS responses for this domain are not cryptographically signed, making cache-poisoning/spoofing attacks against DNS resolvers (not the app itself) theoretically easier. This is a low-severity, defense-in-depth control for most SaaS applications.

Impact:This scan checked 17 candidate subdomain(s) — a common-name wordlist plus any hostnames found in the page and its scripts. It did not perform a full DNS zone transfer or certificate-transparency-log search, so subdomains not in that set and not linked anywhere on the site itself would not be found.

Impact:The client bundle calls .insert()/.update()/.delete() directly against a database table from browser JavaScript (a common Supabase/Firebase pattern AI tools generate). This is a completely normal, safe pattern *if and only if* Row Level Security (or equivalent rules) correctly restrict who can do what to which rows. It is a real vulnerability if RLS is missing, disabled, or misconfigured for the affected table.

Evidence:Client-side .insert()/.update()/.delete() call pattern found in publicly downloadable JS

This finding is a pointer, not a verdict — see the Supabase RLS / Firebase Security findings elsewhere in this report for the actual test of whether these calls are safely restricted. If RLS passed for the relevant tables, no action needed here.

Impact:Business-logic flaws (client-controlled pricing, negative quantities, missing ownership checks, replayable discount codes) can only be confirmed by attempting a real, authenticated transaction and observing what the server actually accepts. This scan is passive/read-only against the public site, so this category is not fully testable from here. The checks below are limited, low-confidence signals worth a manual look — not a substitute for actually testing your checkout/order flow.

Impact:Sites without favicons look unfinished in browser tabs and bookmarks. Google also displays favicons next to search results — a missing one makes your listing look less credible than competitors.

Evidence:No <link rel="icon"> or similar favicon tag found in HTML

Add to your <head>:
<link rel="icon" href="/favicon.ico">
Or PNG: <link rel="icon" href="/icon.png" type="image/png" sizes="32x32">