patchlabs-cli

A command line scanner for apps built with Lovable, Supabase, Bolt, Replit or Cursor. It reads your code, your dependency list and your SQL files, and it can run one passive check on a live site. It is free and open source under Apache-2.0.

It never connects to a database, never runs or rebuilds your migrations, and never runs or imports your code. It sends no repository contents anywhere. The only network calls are the dependency lookup to OSV (package names and versions only, skip it with --offline), and the requests to the site you give to patchlabs headers.

What it checks

Code, dependencies and SQL: patchlabs scan

ID	Severity	What it looks for	Title shown
PL-010	critical, high	Supabase service role keys, live Stripe or Supabase secret keys, and secrets behind a public env prefix (VITE_, NEXT_PUBLIC_, ...) in browser code or .env files	Service role key in client code
PL-017	high, info	Edge functions with JWT checks off that use the service role key and check the caller nowhere	Edge function open without sign-in while using the service key
PL-018	low	Email confirmation switched off in supabase/config.toml	Sign-ups need no email confirmation
PL-019	critical, high	Access decided from user_metadata, which users can change themselves	Access decided by user_metadata, which users can edit
PL-020	high	Admin email lists, or admin flags in browser code or browser storage	Admin check only in the browser
PL-021	high	Stripe, Lemon Squeezy or Paddle webhook that reads the body and does not check the signature	Payment webhook doesn't verify its signature
PL-022	high	Server code that uses the service role key and takes the user id from the request	Server route trusts a user id sent in the request
PL-023	critical to medium	npm dependency with a known advisory, from OSV	Dependency with a known vulnerability
PL-024	medium	HTML inserted from a value that is not a literal (innerHTML, dangerouslySetInnerHTML, v-html, {@html}) without sanitising	User content rendered as raw HTML
PL-025	critical, high, info	Firebase or Realtime Database rules that allow anyone, or any signed-in user, to read or write	Firebase rules allow anyone to read and write
PL-026	medium, info	Server code that allows any origin through CORS and also uses cookies or credentials	Any website can call a signed-in function (CORS reflects any origin)
PL-001	critical	A policy that lets the public or anon role read personal columns	Anyone with the public key can read personal data
PL-002	high, medium	A policy that lets any signed-in user read every row	Any signed-in user can read all rows
PL-003	low	Row level security on, with no policies	Row level security is on but the table has no policies
PL-004	medium	An UPDATE policy with no WITH CHECK	UPDATE policy without WITH CHECK
PL-005	high, medium, low	A policy whose condition is always true	Policy is always true
PL-006	high, medium	A SECURITY DEFINER function with no fixed search_path, or callable by anon	SECURITY DEFINER function exposure
PL-007	medium	A public storage bucket	Public storage bucket
PL-008	critical, high	Row level security not enabled on a public table	Row level security is not enabled

The SQL checks (PL-001 to PL-008) read the text of the Supabase *.sql files in the repository (see Limits), except dependency and build folders such as node_modules and dist. They do not run the SQL and do not test anything. Migrations are read in order, one project folder at a time.

Live site: patchlabs headers

ID	Severity	What it looks for	Title shown
PL-027	medium	http:// does not redirect to https://	Site doesn't force HTTPS
PL-028	high, medium	Certificate invalid or expired (high), or expiring within 21 days (medium)	TLS certificate is invalid, expired or about to expire
PL-029	low	No Strict-Transport-Security, or max-age under 180 days	No HSTS header, or max-age under 180 days
PL-030	medium	No Content-Security-Policy	No Content-Security-Policy
PL-031	low	No frame-ancestors in the policy and no X-Frame-Options	Any site can frame the page
PL-032	low	No X-Content-Type-Options: nosniff	No X-Content-Type-Options: nosniff
PL-033	medium	A cookie without Secure, or a session cookie without HttpOnly	Cookie set without Secure, or a session cookie without HttpOnly
PL-034	medium	A script or stylesheet loaded over plain http://	Page loads scripts or styles over plain HTTP
PL-035	info	Version numbers in Server or X-Powered-By	Server headers reveal software versions
PL-036	info	No Referrer-Policy	No Referrer-Policy

The grade is A (90 or more), B (75 or more), C (60 or more), D (40 or more) or F. Each failed check takes 30 points for high, 15 for medium and 5 for low. An invalid or expired certificate is always F.

patchlabs headers makes one plain http:// GET of the home page, to see whether it redirects to HTTPS. It then makes one https:// GET of the home page, and follows redirects on that request, up to five hops. It does not crawl, and it does not request any other path. A host that resolves to a private or local address is refused.

Install

Needs Python 3.9 or newer. There are no other dependencies.

pipx install git+https://github.com/manra399/patchlabs-cli

Or run it without installing:

uvx --from git+https://github.com/manra399/patchlabs-cli patchlabs scan .

It also runs as a module: python3 -m patchlabs_cli scan .

This is the beginning of the README. Read the rest at the original. Read the full README ↗