// the main checks it runs
What GuardLayer checks for
36 checks, run on every push and tuned to stay quiet on safe, idiomatic code. Each one ships with the exact fix — not just a flag.
# supabase
7 checksWhere most Next.js + Supabase breaches actually start — the rules that decide who can read and write your data.
- criticalRLS disabled on a table
- criticaltables created without RLS and granted to anon
- criticalservice_role key exposed client-side
- criticalpublic storage buckets
- warningpolicies missing auth.uid()
- warningedge functions without auth
- warninggetSession() trusted in server code
# next.js
6 checksThe framework-specific footguns — Server Actions, environment exposure, and request handling in routes and middleware.
- criticalsecrets leaked via NEXT_PUBLIC_
- warningServer Actions that write data without an auth check
- warningAPI routes passing request input to dangerous sinks
- warningwebhooks without signature verification
- warningwildcard CORS with credentials
- infoauth middleware with no route matcher
# general
5 checksClassic application-security mistakes the AI coding tools still ship into production.
- criticalhardcoded API keys & private keys
- warningdependencies with known CVEs
- warningstring-built SQL (injection)
- warningeval() on dynamic input
- infounsanitised dangerouslySetInnerHTML