Verified reportOwnership confirmed — all checks complete.

Production audit

Meadowlark Landscaping — Customer Portal

meadowlark-portal.lovable.app·Tested 21 July 2026·Read-only

One finding is serious — anyone can read your customer records. Two more need attention, and two checks came back clean. Here’s exactly what we found, in plain English, with the proof.

1 exposed2 need attention2 look OK

ExposedConfirmed

Anyone can read your customer records

What we found

Evidence · captured 21 Jul 2026 · read-only, count-onlycustomers table

# A request anyone on the internet can make — no login, no key of yours.
# We ask only "how many?" — we never pull the records themselves.
HEAD /rest/v1/customers?select=id HTTP/2
Host: ████████.supabase.co
apikey: eyJhbGci…  (the public key printed in your app’s own page source)
Prefer: count=exact

HTTP/2 200 OK
content-range: */4,214   ← 4,214 customer rows are readable by a stranger

# Columns exposed on this table (names only — we read no rows):
#   name · email · address · last_invoice · balance_due

Values are mocked and redacted. We ask only for a count — we never store, display, or download your customers’ records.

What it means for you

Anyone with the web address can pull your full customer list — every name, home address, and invoice amount — without logging in.

In Massachusetts, a leak of names with addresses can trigger a breach-notification duty: you may be legally required to write to all 4,214 customers and notify the state. Beyond the paperwork, this is the kind of thing a competitor or a local reporter could find, and it puts your customers’ home addresses in the open.

We're not showing the fix here. Closing this cleanly — without breaking your app — is the part we do for you. The diagnosis above is free.

Needs workConfirmed

Files your customers uploaded can be listed by anyone

What we found

Evidence · captured 21 Jul 2026 · read-only, list metadata onlystorage bucket

GET /storage/v1/object/list/customer-uploads   (bucket is public)
HTTP/2 200 OK — 1,807 file names listed to an anonymous request

  contracts/2024/████████-signed.pdf
  site-photos/██████-backyard.jpg
  invoices/INV-█████.pdf
  id-scans/████████.jpg          ← anyone can enumerate every file name
  … 1,803 more

File names are mocked and redacted. We list metadata only — file names, never their contents.

What it means for you

The storage that holds signed contracts, site photos, and invoices lets a stranger list every file by name.

Even without opening a file, a predictable name (like INV-00042.pdf) can be guessed and fetched. It’s a quieter risk than the one above, but it exposes documents your customers assumed were private.

Fix not shown — it ships with the quote if you decide to go ahead.

UnverifiedDetection only — needs your go-ahead to test

Your payment webhook may accept forged requests

What we found

Evidence · detection only · nothing sent to your appstripe-webhook

# We can see your app calls a Stripe payment webhook:
POST /functions/v1/stripe-webhook   (endpoint present in your app)

# Whether it properly rejects a FORGED "payment succeeded" message can only
# be confirmed by sending a test event to your LIVE app — which we will not
# do without your go-ahead. We did not send anything to this endpoint.
STATUS: needs your go-ahead to test safely

We detected the endpoint in your app’s own code. We sent it nothing — confirming it safely needs your go-ahead.

What it means for you

If this is confirmed, someone could fake a “payment succeeded” message and mark invoices paid without any money arriving.

We’ve flagged it, not proven it — confirming means sending a test payment event to your live app, and we won’t do that without your explicit go-ahead. The same read-only promise, applied to your money.

Give us the go-ahead and we'll safely confirm this — still free.

OKConfirmed

Your connection is properly secured

What we found

Evidence · captured 21 Jul 2026 · read-only probetransport

GET https://meadowlark-portal.lovable.app
strict-transport-security: max-age=63072000; includeSubDomains; preload
✓ HTTPS enforced   ✓ HSTS present   ✓ TLS 1.3

Traffic between your customers and your app is encrypted and can’t be silently downgraded. Nothing to do here — we’re showing it so you can see what a clean result looks like.

OKConfirmed

No secret keys are exposed in your app

What we found

Evidence · detection only · nothing sent to your apppage source

# Read from your app’s public page source — what any browser already downloads:
GET /  →  scanned the shipped code for exposed secrets
✓ No secret or service keys found in your bundle
✓ Only the public API key is present (safe by design — it’s meant to be seen)

The powerful keys that could unlock your whole backend aren’t leaking through your app’s code. The only key visible is the public one that’s supposed to be there. Nothing to do — shown so you can see another clean result.

What we tested — and what we didn't

An honest snapshot, as of 21 July 2026. This is not a guarantee your app is secure.

We checked

Public data access — a count only, never the records
File storage exposure — file names only
Secure connection & transport
Payment webhook — detected, not probed
Public keys accidentally shipped in your app

We did not

Log in, or test anything behind a password
Download or read any customer record or file
Send any request to your payment webhook
Touch your source code or hosting account
Test third-party tools you connect to

We looked from the outside, the way anyone on the internet could — read-only. A clean result here means we didn't find these specific problems, not that none exist.

Want the serious one fixed?

Reply to this report and we’ll send back a fixed-price quote to close the critical exposure — and the file-listing issue — with no surprises. No call required.

Reply for a fixed-price quote

DODana Ortiz reads and answers every reply — usually same day.

Read-only — we changed nothing You own everything — leave anytime Insured, real company

Not the technical one?Send this to whoever helps with your app — it’s built to be read by both of you.