Sample Report

What A ZipLoom Security Report Looks Like

This is a sample. The app, its repository, its domain and its findings are made up to show what a report contains. The layout is simplified; in ZipLoom the same findings appear in your dashboard.

Two reads of one app: the code in your repository and the site your visitors load. Every finding says what is wrong, where, why it matters and how to fix it — worst first.

Critical

High

Medium

Low

acme-notes/notes-app · commit 4f1c9a2e · notes.example.com

In Your Code

CriticalSupabase table created without enabling Row-Level Security

supabase/migrations/0003_notes.sql:1

Why it matters. Row Level Security is off on the notes table, so anyone with the public anon key can read and change every user's notes.

The fix. Enable Row Level Security on the table and add policies that limit each row to its owner (for example `auth.uid() = user_id`).

Fix brief for your AI coding tool

Fix a CRITICAL security finding in acme-notes/notes-app.

**Supabase table created without enabling Row-Level Security**
- Location: `supabase/migrations/0003_notes.sql:1`

What's wrong: Row Level Security is off on the notes table, so anyone with the public anon key can read and change every user's notes.

The code:
```
create table public.notes (
  id uuid primary key default gen_random_uuid(),
  user_id uuid not null,
  body text
);
```

Required fix: Enable Row Level Security on the table and add policies that limit each row to its owner (for example `auth.uid() = user_id`).

Apply the fix at the location above. Do not change unrelated behaviour, and
do not suppress the warning instead of fixing it. If the fix requires a
decision I have to make, say so rather than guessing.

CriticalStripe live secret key in source
src/lib/billing.ts:4
Why it matters. A live payment key is committed in the source: anyone who can read the repository, or its history, can use it.
The fix. Rotate the key now, then load it from a server-side environment variable. Removing it from the file does not remove it from history.
HighCommand Injection in lodash
package-lock.json
Why it matters. The lockfile pins lodash 4.17.20, which has a published advisory (CVE-2021-23337).
The fix. Upgrade lodash to 4.17.21 or later and commit the updated lockfile.

Open any finding's fix brief and paste it into the AI tool that wrote the code: it carries the file, the line, the code and the fix, so the tool does not have to ask where.

On Your Live Site

HighNo Content-Security-Policy
Live site · notes.example.com
Why it matters. Without one, an injected script runs with the full rights of your page.
The fix. Add a Content-Security-Policy header, starting from `default-src 'self'` and allowing only the sources the app uses.
MediumGraphQL schema can be downloaded by anyone at /api/graphql
Live site · notes.example.com
Why it matters. The full map of your API is a head start for anyone probing it.
The fix. Turn introspection off in production and confirm every resolver checks who is asking.
Low1 POST form without a visible anti-CSRF token
Live site · notes.example.com
Why it matters. Another site may be able to submit this form as a signed-in user.
The fix. Add a per-session anti-CSRF token, or confirm the session cookie is SameSite=Lax or Strict and the endpoint rejects cross-site requests.

Live-site findings come from the check ZipLoom runs on your app after each deploy. The free quick scan covers part of it: security headers, email security, exposed source maps and CORS.

Take It Where You Work

The findings in your code, in the formats your tools read. Download them as SARIF 2.1.0 for your code host's code-scanning view (one result shown):

{
  "ruleId": "ZL-719FF4C9",
  "level": "error",
  "message": {
    "text": "Stripe live secret key in source. Rotate the key now, then load it from a server-side environment variable. Removing it from the file does not remove it from history."
  },
  "locations": [
    {
      "physicalLocation": {
        "artifactLocation": {
          "uri": "src/lib/billing.ts"
        },
        "region": {
          "startLine": 4
        }
      }
    }
  ],
  "partialFingerprints": {
    "ziploomFinding/v1": "C6A0F4A2"
  },
  "properties": {
    "severity": "critical"
  }
}

A pipeline gets one answer it can act on. Failing at high, this scan returns exit code 1: 3 finding(s) at or above high. A scan that could not finish never returns a pass.

Your AI coding tool can ask for your code's findings directly, through ZipLoom's MCP server.

What A Report Never Shows

How a check decided. You get the finding, where it is and how to fix it; the rules behind it stay on our side, so a report is not a guide to tuning an attack until it slips past.

Scan My Site Free See Plans