what FlareX checks
Everything between “it works” and “it’s safe.”
Deterministic scans find where to look. AI explains what each finding means in plain English. Risky fixes are flagged for human approval — never applied silently.
What FlareX checks
Secrets & key exposure
- Service-role / API keys bundled into frontend code
- NEXT_PUBLIC_* / VITE_* variables holding secrets
- Live keys (Stripe, AWS, GitHub) committed to the repo
Auth & sessions
- Missing or hardcoded session secrets
- Misconfigured auth callbacks
- Unprotected routes and admin endpoints
Database & data rules
- Supabase Row Level Security missing or off
- API routes that touch the DB with no auth check
- Database connection / migration risks
Payments & webhooks
- Stripe webhooks without signature verification
- Missing webhook signing secrets
- Payment success/failure handling gaps
Build & deployment
- Missing build/start scripts or wrong Node version
- No lockfile, phantom or broken dependencies
- No Dockerfile / unclear entry point
Monitoring, backups & rollback
- No logs or uptime checks
- No backups, no rollback path
- No staging environment before production
Supported stacks
FlareX focuses on Node, Next.js, React, Vite, Express, Supabase, Prisma, Postgres, and Stripe-based apps. GitHub repo or ZIP import.
No silent changes
Auth, payments, database, and secret changes always require your approval. FlareX never rewrites security-critical code on its own.