Security review for apps nobody read line by line
Generated code ships with missing ownership checks and live credentials more often than exotic exploits. PushFix hunts the classes of problem that prove themselves, then shows you the evidence.
- Free during early access
- No credit card
- Staging-first
- Evidence for every finding
How the security family is organised
136 security checks across the areas where generated applications actually fail, led by access control and credential exposure.
Publishable keys are not treated as leaks. When PushFix finds a Stripe publishable or a Supabase anon key, it reports the unprotected data behind it instead of the key itself.
What makes an automated security review trustworthy
The rules below are not marketing. Each one exists because a less careful automated review reported something that was not true.
Black-box by design
PushFix tests the deployed app the way an outsider sees it. No repository access, no agents, no special build. If a visitor or a signed-in user can reach it, it is in scope.
Non-destructive, always
Only six checks write anything, always to disposable records the audit itself created, and only with explicit write consent. Irreversible paths are excluded up front.
Evidence, not a score
Every security finding carries the request, response or bundle excerpt that produced it, plus reproduction steps and a confidence score, so you can verify the claim yourself.
A fact is not an inference
A missing header is reported as observed at high confidence. A judgement call is capped at 0.60 and labelled. You always know which kind of finding you are reading.
It reviews your app without risking it
Active security testing against a live product has to be boring. The worst case should be a handful of read-only requests, never a broken environment.
- Staging-first: production targets are flagged and tested conservatively.
- Request budgets: 3 requests/second, 20 per check and 1,500 per audit.
- At most 5 authentication attempts per account, then it stops.
- Irreversible paths such as delete-account and payment capture are never exercised.
- Injection is reported as indicators only: a weakness is proven to exist, never exploited.
- No load testing, no brute force, no social engineering, no denial of service.
Not a penetration test. Automated, external and non-destructive by design. PushFix reports what automated review can prove with evidence.
Risk tiering across the catalogue
Every check declares how disruptive it is. An unrecognised check defaults to the stricter tier, never the looser one.
- Passive71
Reads only what any visitor receives
- Safe-active207
Sends its own read-only requests
- Invasive6
Writes only to records it created
278 of the 284 checks never change a single record.
What PushFix refuses to do
A security tool is only as trustworthy as the activities it declines. These are prohibited outright, not merely discouraged.
- No destructive payloads or data loss of any kind
- No denial-of-service, flooding or load testing
- No brute force beyond the configured attempt cap
- No social engineering and no contacting real users
- Nothing against a host you have not authorized
- No exploitation of a weakness that is only reported, never chained
See how this differs from a code scanner or a full DAST suite: read the comparisons.
Find what an attacker
would see first.
Point PushFix at a staging environment and get an evidence-backed security review that also covers SEO, accessibility and performance.
Prefer to look around first? Compare plans