Sample report
Sample report: example-bakery.com
This is a made-up example. The site (example-bakery.com) is not a real customer and the results are invented. The layout and the kind of fixes are real. Your report lists your own findings.
Fix prompts are written for Lovable in this example. You pick your builder at checkout (Lovable, Bolt, Replit, Cursor, v0, Bubble or other).
Findings
critical /.env file is publicly downloadable
Proof: Your environment file (often containing secrets) can be downloaded. · https://example-bakery.com/.env
Fix: Remove the file from the public folder, then rotate every key that was in it.
Fix prompt for your builder
Paste this into the Lovable chat: "Security fix needed: /.env file is publicly downloadable (found at https://example-bakery.com/.env). Remove the file from the public folder, then rotate every key that was in it. Do not change unrelated features. After the change, explain what you changed and confirm no secret keys remain in frontend code or VITE_/NEXT_PUBLIC_ variables."
high Table "orders" is readable by anyone
Proof: Anonymous read returned data. Columns: id, email, total (looks like personal data). Row contents were not stored. · https://xxxx.supabase.co/rest/v1/orders
Fix: Enable Row Level Security on this table and add policies so users can only read their own rows.
Fix prompt for your builder
Paste this into the Lovable chat: "Security fix needed: Table "orders" is readable by anyone (found at https://xxxx.supabase.co/rest/v1/orders). Enable Row Level Security on this table and add policies so users can only read their own rows. Do not change unrelated features. After the change, explain what you changed and confirm no secret keys remain in frontend code or VITE_/NEXT_PUBLIC_ variables."
medium No Content-Security-Policy
Proof: Response is missing the content-security-policy header. · https://example-bakery.com
Fix: Add a Content-Security-Policy header (start with default-src 'self' and allow only the domains you use).
The Fix it pack also adds a re-check button under each finding, a PDF, and 30 days of re-checks. DeployVet is not a penetration test. A clean report means we did not find the issues we check for.