Explore a real report.

Choose a real scan examplePublic websiteA dummy credential, its fix and a rescan.Supabase databaseAnonymous reads and isolation between two users.

Meet Lunchbox, our controlled demo app. These recorded results came from the released scanner reading its actual public HTML and JavaScript. The credential-shaped string was deliberately nonfunctional.

Compare the same app before and after the fix Before the fix After the fix

Findings & fix prompts What passed Downloads Hand-over preview Compare the sample reports

This local HTTP surface-scan example does not demonstrate backend or cross-user tests. The local HTTP warning remains after the dummy key is removed. Switching views replays recorded snapshots; it does not start a new scan. Scan your own app ↗

JavaScript enables comparison and copy controls. Read the before report or read the after report as plain text. For the Supabase database example, read the before and after snapshots.

Getting your stack check ready…

Explore a real report.

Same table. Two users. Different access rules.