✓CSRF Protection✓Rate Limiting✓Input Validation✓Security Headers✓Auth / Session✓Audit Logging✓Request Size Limits✓Redis Caching✓Cache Headers○Encryption
5 open issues
High~17 tables referenced in API routes have no schema SQL — RLS status unknown (workflows, automations, compensation, performance, agents, voice)Open
High18 API routes have conditional org guard that silently degrades to no-filter when orgId is nullOpen
MediumUser profile/search endpoints expose data across orgs (IDOR) — no org membership checkOpen
+2 more →✓CSRF Protection✓Rate Limiting✓Input Validation✓Encryption✓Security Headers✓Auth / Session✓Cache Headers
5 open issues
Medium/api/og endpoint is open URL fetcher with no auth — SSRF risk against internal servicesOpen
Highnotifications INSERT policy WITH CHECK(true) — any authenticated user can create notifications for any user (spam/social engineering)Open
Mediumcontent_hashes INSERT allows user_id impersonation — no auth.uid() check in RLS policyOpen
+2 more →✓CSRF Protection✓Rate Limiting✓Input Validation✓Encryption✓Security Headers✓Auth / Session✓Cache Headers
3 open issues
Highuser_encryption_keys RLS policy USING(true) exposes encrypted master keys to all authenticated usersOpen
Highveil_passkey_credentials and veil_webauthn_challenges RLS policies USING(true) — any user can read/write all passkey dataOpen
Medium/api/assistant/chat missing CSRF protection (main /api/chat has it)Open
✓CSRF Protection✓Rate Limiting✓Input Validation✓Security Headers✓Auth / Session✓Cache Headers○Encryption
2 open issues
Medium/api/subscribe/preferences identifies subscribers by email only — no token verification, allows enumeration and modificationOpen
Low/api/synthesize allows any authenticated user to publish AI synthesis to events feed — content injection riskOpen
✓CSRF Protection✓Rate Limiting✓Input Validation✓Encryption✓Security Headers✓Auth / Session✓PHI Audit Trail✓Cache Headers
5 open issues
Criticalmedical_records table used in API routes but has NO migration SQL — RLS status unknown, potential PHI exposureOpen
Highpayments table INSERT/UPDATE RLS policies are WITH CHECK(true) — any authenticated user can insert/modify payment recordsOpen
MediumAny verified doctor can read ALL patient escalations, not just their own patientsOpen
+2 more →✓CSRF Protection✓Rate Limiting✓Input Validation✓Security Headers✓Auth / Session✓CORS✓Cache Headers
5 open issues
Mediumself-register endpoint fully open — any anonymous caller can create agents under Sylys account (rate-limited 10/hr)Open
Highlogin_history INSERT policy WITH CHECK(true) — any authenticated user can forge login events for other usersOpen
Highrecovery_codes policy WITH CHECK(true) no USING clause — all recovery code hashes readable by any authenticated userOpen
+2 more →✓CSRF Protection✓Rate Limiting✓Input Validation✓Security Headers✓Auth / Session○Encryption
5 open issues
Hightips/recent API endpoint unauthenticated — leaks creator financial data (earnings, supporter IDs) via service roleOpen
HighPasskey/WebAuthn RLS policies use USING(true) — any user can read/write all credentialsOpen
Mediumcheck-copyright accepts untrusted userId from request body — user can attribute hashes to other usersOpen
+2 more →✓CSRF Protection✓Rate Limiting✓Input Validation✓Security Headers✓Auth / Session○Encryption
4 open issues
Highcheck-copyright has NO auth — unauthenticated writes to content_hashes via service role; attacker can poison hash tableOpen
HighPasskey/WebAuthn RLS policies use USING(true) — any user can read/write all credentialsOpen
Mediumtips/recent endpoint unauthenticated — exposes creator earnings totals publiclyOpen
+1 more →✓CSRF Protection✓Rate Limiting✓Input Validation✓Security Headers✓Auth / Session○Encryption
1 open issue
Mediumtips/recent endpoint unauthenticated — exposes creator earnings totals publiclyOpen
✓CSRF Protection✓Rate Limiting✓Input Validation✓Security Headers✓Auth / Session✓Encryption
5 open issues
Highcheck-copyright has NO auth — unauthenticated writes to content_hashes via service roleOpen
HighPasskey/WebAuthn RLS policies use USING(true) — any user can read/write all credentialsOpen
Mediumchannel_memberships table missing INSERT/UPDATE/DELETE RLS policiesOpen
+2 more →✓CSRF Protection✓Rate Limiting✓Input Validation✓Security Headers✓Auth / Session○Encryption
4 open issues
Highcheck-copyright has NO auth — unauthenticated image uploads and hash writes via service roleOpen
Hightips/recent unauthenticated — leaks creator financial data via service roleOpen
Mediumcontent_ai_consent INSERT/UPDATE RLS open to all authenticated usersOpen
+1 more →○CSRF Protection○Rate Limiting○Input Validation○Security Headers✓Auth / Session○Encryption
✓CSRF Protection✓Rate Limiting○Input Validation✓Security Headers✓Auth / Session○Encryption
✓CSRF Protection✓Rate Limiting✓Auth / Session✓Cache Headers
✓CSRF Protection✓Rate Limiting✓Auth / Session✓Webhook Auth✓Agent Auth
✓CSRF Protection✓Rate Limiting✓Auth / Session✓Input Validation✓Security Headers
✓Cross-subdomain SSO✓CSRF Protection✓Rate Limiting✓Input Sanitization✓Auth Middleware
✓Auth / Session○Encryption✓Input Validation
✓Auth / Session✓Input Validation○Security Headers
✓WebAuthn Passkeys✓Cross-Subdomain SSO✓RLS Policies✓Payment Security
3 open issues
HighFarmer payouts not functional (UI only)Fixing
HighNo logistics tracking or shipping integrationOpen
MediumQuality verification AI not implementedOpen