What is this site not?
It is not a penetration test, not a hosted scanner, not legal advice, and not a 19-item essay replacing every security concern. It is a local pass/fail gate for ownership isolation, refund entitlement kick, and admin route refusal — the three modules called out most often before first payment.
How is this different from long printable checklists?
Long articles are excellent references. This tool forces an interactive status per module and emits a remediation list you can paste into an issue. If you need the full nineteen-item universe (secrets, rate limits, headers), use a broader checklist after these three are green.
May I run this against someone else’s app?
No. Only test applications you own or are explicitly authorized to test. Use fake data and payment test mode. Unauthorized access attempts can be illegal.
Is anything uploaded?
No. Module selections stay in the browser. There is no account system and no server that stores your answers. CDN request logs for page views may still exist at the host.
We enabled RLS / a builder security toggle — is that enough?
Usually not. “RLS enabled” or a green advisor often means policies exist, not that User B is blocked from User A’s rows. The ownership probe is the proof; keep it even when scanners are green.