User guides

What each Tenty check looks for, why it matters, how to fix a finding and how to see it yourself

• AI endpoints anyone can callAn endpoint that forwards prompts to an AI provider can run up your bill when strangers can call it.
• API descriptionsAn API description, usually an OpenAPI or Swagger file, lists every endpoint of your app and says which ones need a credential. The server has to enforce what the file says.
• Basic Auth over httpBasic Auth sends the password with every request, so the connection has to be encrypted.
• CORSCORS decides which other sites may read answers from your server.
• Data inside the pageData embedded in a page for the app's own use is readable by every visitor.
• Development mode in productionDevelopment servers and debug pages show more than a live site should.
• Domain expiryA domain that lapses takes the site and its email down, and someone else can register it.
• Email recordsSPF and DMARC records tell receivers which servers may send mail as your domain.
• Exposed admin and debug toolsAdmin consoles, debug pages and API explorers belong behind a login or on a private network.
• Exposed filesFiles that belong on a developer machine sometimes end up in the public folder of a site.
• Exposed source mapsA source map is the key that turns a minified script back into your original code.
• Firebase rulesFirebase databases protect their data with rules. The Realtime Database and Firestore web addresses ship in your page, so the rules are the only protection the data has.
• GraphQL endpointsA GraphQL endpoint can describe its whole schema to any caller. This feature is called introspection, and it is meant for development tools.
• HTTPS and certificatesHTTPS protects every request between your visitor and your site, and a valid certificate is what makes browsers trust it.
• Keys that are public on purposeSome keys are made to sit in a page. They stay safe when the provider side is set up for it.
• Leaked environment variablesVariables with a public prefix are copied into the page at build time.
• Leaked secret keysA secret key that ships in a page or a script file belongs to everyone who opens the site.
• Leftover hosts and addressesCode that points at a staging, internal or local host tells attackers where to look.
• Open storage bucketsA storage bucket holds the files of your app: uploads, images, exports. When the bucket lists its files to anyone, every file name is visible and every file can be downloaded.
• Privacy policy and termsVisitors and buyers need to find the rules of the site.
• security.txtA security.txt file tells researchers where to report a problem.
• Sensitive paths in robots.txtA robots.txt lists paths for search engines, and every visitor can read it.
• Servers outside the CDNA CDN protects a site only when every name goes through it.
• Session cookiesThree flags decide who can read a login cookie.
• Subdomain and script host takeoverA name that points at a service nobody runs any more can be claimed by anyone.
• Supabase keys and tablesSupabase apps put a public key in the page on purpose. Row level security is the lock that makes that safe.
• Third-party scriptsA script from another site runs with full access to your page.
• Vulnerable librariesLibraries with a publicly known hole get found by searching for their version.
• Web basics and security headersResponse headers tell the browser how to treat your site. A few lines add a lot of protection.
• What Tenty detects about your stackTenty names the services your app is built on and shows them as facts.