Illustrative report

Sample security report

What a scan of a made-up AI-built app looks like: every finding with the evidence behind it, the fix to hand your coding assistant, how to verify it, and what the scan could not check. The engine built it from synthetic facts the same way it builds a real result, so it changes when the rules do.

3things worth fixing1 critical2 medium

We start with the most severe. Each one below has the evidence, fix instructions for your coding assistant, and a way to confirm it worked.

11 checks performed

xlogs can be wrong. Treat these as leads to check, not verdicts. Confirm one against your own code before acting on it, especially before rotating a credential or changing production. Seen: confirmed means this scan observed it directly on your live site (rows came back, a file was served, a key was in the code it serves). What it means is a separate label: potential when it depends on something xlogs did not test or cannot know, such as whether a table is meant to be public.

Every fix in one paste

3 findings, ordered by severity, each with what was observed, the fix, and how to verify it.

CriticalSeen: confirmedthis scan observed itMeaning: potentialwhether the key still works was not tested

A credential-shaped value is publicly served

What this means

A value shaped like a private key or password is in code your site serves, where anyone can read it. If it still works, anyone who copies it can act as you: run up bills, read your data, or send email in your name. xlogs did not test it.

1FindEvidence (read-only)

A JWT whose decoded role claim is service_role (signature not verified) is in your client code at https://acme-vibesupabase.app/assets/app.js (eyJh••••••••ture (148 chars)). A service_role key bypasses row level security, so if this is a real key for your project, anyone who copies it can read and write your entire database; xlogs did not test it. It must never reach the browser. https://acme-vibesupabase.app/assets/app.js

2FixHow to fix it

3VerifyConfirm it is gone

After you deploy the fix, xlogs re-scans your live app and your files and confirms the key is no longer present.

Your deployment

Everything we observed. None of it is scored, and none of it is a problem by itself.