Exposed secretsAPI keys, tokens and committed .env values reachable from the browser or repo.
Missing authenticationEndpoints that return data without checking who is asking.
Open Supabase RLSTables any visitor can read or write because Row Level Security is off.
Client-side secretsService-role keys and admin logic shipped to the browser.
No rate limitingLogin, signup and payment routes open to brute force and abuse.
Security headersMissing CSP, HSTS and X-Frame-Options; misconfigured CORS.
SEO & metadataMissing titles, descriptions, robots and sitemap signals.
AI readiness (AEO)Whether AI engines can read and cite your app (llms.txt, structure).