Securealy

Run rls-policies and supabase-auth-config against the user's own Supabase project using credentials already in this server's environment: SUPABASE_URL plus SUPABASE_SERVICE_KEY (or SUPABASE_SERVICE_ROLE_KEY), or SUPABASE_MGMT_TOKEN plus SUPABASE_PROJECT_REF. rls-policies lists tables in the public schema with row level security off or with permissive policies; supabase-auth-config reads the auth settings (open signup, email confirmation, OTP expiry). Each value is trimmed, sent only to that Supabase project, and never appears in the output. The service key is sent only to an https URL on a Supabase-hosted domain (the project URL Supabase issued); any other SUPABASE_URL skips the check unless SECUREALY_SUPABASE_HOST_OVERRIDE=1 is set for a self-hosted project. If a variable is missing the check is skipped with a reason; tell the user which variable to export, never ask them to paste it into the chat.

Run stripe-webhook-wiring with STRIPE_SECRET_KEY from this server's environment: confirms a live-mode key is in use, that at least one enabled webhook endpoint points at the production host, and that it subscribes to the checkout and subscription events. The key is trimmed, sent only to api.stripe.com, and never appears in the output. Provide productionHost so the endpoint host can be compared.

Run vercel-env-hygiene with VERCEL_TOKEN (a project-scoped token is enough) and VERCEL_PROJECT_ID from this server's environment, or the project id passed here. Reports secret-looking variables exposed to the browser through a NEXT_PUBLIC_ or VITE_ prefix, test keys in production, and production values missing from preview. The token is trimmed, sent only to api.vercel.com, and never appears in the output. Variable values are fetched only when SECUREALY_VERCEL_DECRYPT=1 is set in the environment; without it the checks that need values (trailing newlines, live keys outside production) are reported as skipped and only names and targets are read.

Fetch the published fix for a check id from securealy.com (GET /checks/<id>.json): the catalogue entry plus the fix text the caller is entitled to. Sends only the check id. If the fix endpoint is not available yet, returns the catalogue entry and the fix page URL to read instead.

Return the catalogue entry for a check id (category, title, severity, tier, what passing means, why it matters, whether the fix is published free) plus the public fix page URL. Use it to explain a failing check to the user before fetching the fix. Local, no network.

Grade a website the way an attacker and a customer would see it, in under a minute. Passive tier (default) runs locally in this process and only does what a browser does when a visitor opens the site, plus DNS and TLS lookups: at most 25 requests, no probing, no credential use; it works on any public URL, including preview deployments. A URL on localhost, 127.0.0.1, [::1], *.localhost or *.test (plain http is fine) gives a pre-launch grade of the app running on this machine: the result carries preLaunch: true, checks that need a public domain (TLS, HSTS, DNS, email, domain, Stripe live key) are skipped with the reason, and the score covers the rest, so the same command on the deployed URL later gives the real grade. Any other private address is refused. Verified tier needs the project token (sly_...) for a domain whose ownership was already proven at securealy.com; it runs on the hosted grader and adds the probes an owner would want (served /.env or /.git, open admin routes, anon row reads, listable buckets, rate limiting). Returns a GradeResult (schema 1) and a text summary: grade A to F, score out of 100, blockers with evidence, then fails and warnings by category, each with its fix page. Pass bypassToken for a Vercel deployment that has protection enabled; it is sent only to that host. Evidence never contains a response body and secrets are redacted to six characters.

List every check Securealy runs, optionally filtered by category or tier, with severity and the one-line meaning of a pass. Local, no network.

Store a GradeResult from a local check (scan_repo, check_rls, check_stripe, check_vercel_env) against the user's Securealy project so it shows in their dashboard. Sends the result and the project token (as a Bearer header) to securealy.com and nothing else. Only call this when the user has asked for the result to be posted.

Run the three local repository checks on a source folder: repo-secrets (secret-shaped strings in the working tree and git history), gitignore-env-coverage (every .env variant ignored) and env-example-parity (.env.example lists every variable the code reads, with no real values). Runs entirely on this machine; nothing is sent anywhere. Findings show a six-character prefix of any secret, never the value. Folder trust: the first call for a path returns a confirmation request instead of results. Show the user the absolute path and call again with trust: true once they confirm it is their project. Trust lasts for this server process.