Sample report · our own site · 18 October 2026
Sample audit report: chikuos.com
This is what a ChikuOS audit report looks like, run on our own site, chikuos.com, on 18 October 2026. It isn't a client and isn't made up: every number below came from the checks described on how we test. Our site is a small static site with no database or login, so the report is short. A typical AI-built app has more findings, especially around Supabase access rules and keys in front-end code; the last section shows what one of those looks like, using clearly marked demo values.
Summary
No security problems found. One medium SEO item (Search Console not verified yet), one low speed item and two informational notes. Lighthouse scores 100 in all four categories on mobile and desktop (Lighthouse 12.8.2).
Findings, ranked
| Severity | Area | Finding and evidence | Fix |
|---|---|---|---|
| Low | Speed | Stylesheet cached for only 1 day. Lighthouse (mobile and desktop) flags /styles.css with a 1-day cache lifetime. The file is linked with a content hash (?v=…), so it can safely be cached for a year. | Set Cache-Control: public, max-age=31536000, immutable for /styles.css in _headers. Fixed on 18 October, after this check. |
| Info | Speed | Third-party analytics script flagged. Lighthouse flags Cloudflare's Web Analytics beacon (about 10 KiB) for legacy JavaScript and a 1-day cache. It's Cloudflare's file, loaded with defer, and doesn't affect the scores here. | Accept. Remove it only if you stop using the analytics. |
| Info | Speed | One render-blocking stylesheet. The 2.2 KB stylesheet blocks first render. LCP is still 1.8 s on mobile. | Optional: inline the critical CSS. Not worth it at this size. |
| Medium | SEO | Search Console not verified yet. Without a verified Search Console property, we can't confirm which pages Google has indexed or see real-user Core Web Vitals there. | Verify the domain in Search Console, submit /sitemap.xml, and request indexing for the main pages. |
What passed
- Security headers: Content-Security-Policy without
unsafe-inlineorunsafe-eval, HSTS (1 year, include subdomains), X-Frame-Options DENY, nosniff, a strict Referrer-Policy and Permissions-Policy. - HTTPS: TLS 1.2 and 1.3 negotiated; certificate from Google Trust Services, valid until 14 January 2027.
- Exposed files:
/.env,/.env.local,/.git/config,/.git/HEAD,/.DS_Store,/package.json,/config.jsonand/server-statusall return 404. - Secrets in front-end code: no API keys, JWTs,
service_role,sb_secret_or Stripe live keys in the homepage HTML or our first-party tool scripts. The site has no database. - Lighthouse: 100 for performance, accessibility, best practices and SEO on both mobile and desktop. Mobile LCP 1.8 s, CLS 0, Total Blocking Time 0 ms.
- SEO basics: canonical tag,
index, follow, valid JSON-LD (Organization, WebSite, ItemList), robots.txt allowing search and AI crawlers, sitemap.xml and llms.txt present.
Not checked in this sample
- Real-user Core Web Vitals: the site launched days ago, and the PageSpeed Insights API was over its daily quota when we ran this, so we didn't check field data.
- The HTTP to HTTPS redirect: port 80 wasn't reachable from the network we tested from. HSTS is set.
- Everything on what we don't check.
Demo: what a Supabase finding looks like
Demo, not a real project or client. The project ref, table name and numbers below are made up to show the format. Our own site has no database.
| Severity | Critical |
|---|---|
| Finding | Table profiles is readable by anyone with the public anon key |
| Evidence | HEAD https://demo-project-ref.supabase.co/rest/v1/profiles?select=* with the anon key from the app's JavaScript returned HTTP 206 with Content-Range: 0-0/1240: 1,240 rows visible to a signed-out visitor. No row contents were read. |
| Why it matters | Anyone who opens the app can copy the key from the browser and download every profile, including email addresses. |
| Fix | alter table public.profiles enable row level security; then a policy that limits rows to their owner, for example create policy "Own profile" on public.profiles for select to authenticated using ((select auth.uid()) = id); Re-run the check signed out and as a second test user. |
Want to check your own project's signed-out exposure for free? Use our Supabase exposure checker.
Get a report like this for your site
The AI Site Audit is $49, delivered within 24 hours. For Supabase apps, the Supabase Data-Leak Check ($99) goes deeper into RLS policies, storage and functions.