Certari

Security review: getcertari.com

Last updated 2026-10-18

Result: Pass, tier 2, checklist v0.1.0.

Reviewed by Certari, an independent security review service, against the Certari review checklist v0.1.0 (tier 2) on 2026-10-18 at commit 2b407c7724bc and deployed URL https://getcertari.com. This statement covers only the items listed below at that point in time.

48 checks passed, 3 returned findings, 5 were out of scope for this tier or not yet automated.

This page lists outcomes only. Evidence and fix guidance are shared with the reviewed party, not published. A pass means no hard fail item was found; it is not a guarantee about anything outside the listed checks.

Findings

  • Debug mode or verbose errors in production (2 items, medium)
  • No rate limiting on sensitive endpoints (5 items, medium)
  • Known vulnerable dependency (15 items, high)

Passed

  • Env file committed to git
  • Secret in source
  • Secret in git history
  • Server secret exposed to client
  • Default or seed credentials active
  • Write endpoint without authentication
  • Authorization enforced only on the client
  • Insecure direct object reference
  • Role or permission taken from client input
  • JWT decoded without verification
  • Session cookie flags missing
  • Weak password handling
  • OAuth redirect or state unchecked
  • Email verification missing where it matters
  • Permissive RLS policy
  • Storage bucket public or unrestricted
  • Sensitive fields returned to client
  • Mass assignment
  • SQL built from user input
  • Database reachable from the internet
  • Cross site scripting
  • Open redirect
  • Server side request forgery
  • Path traversal
  • Command injection
  • CSRF on cookie authenticated endpoints
  • Prompt injection into privileged context
  • LLM tools exceed user scope
  • LLM output rendered or executed unsafely
  • No spend or rate limit on model calls
  • Payment webhook signature not verified
  • Price or amount taken from the client
  • Fulfillment before payment confirmed
  • Inbound webhook without authentication
  • Webhook not idempotent
  • HTTPS not enforced
  • Permissive CORS
  • Security headers missing
  • Lockfile missing or not committed
  • Source maps shipped to production
  • Build artifacts or .git served publicly
  • PII in logs or analytics
  • No account or data deletion path
  • Backups or exports accessible without auth
  • Admin or debug surface exposed
  • GraphQL introspection or unlimited queries
  • Dangling DNS
  • Cron or job endpoint callable by anyone

Not covered by this review

  • Row level security disabled
  • Firebase rules open
  • Sensitive data sent to a model provider without disclosure
  • Suspicious or hallucinated package
  • Preview deployments public with production config

← Back to getcertari.com