Security & Audits
Last full scan: Today, 06:00 UTC
Open findings
5
Critical
1
Endpoints up
5/6
Compliance
67%
Findings
| ID | Issue | Repo | Type | Severity | Status |
|---|---|---|---|---|---|
| F-101 | Stripe secret key committed in .env.example | gameday-dashboard | Secret leak | critical | open |
| F-102 | Supabase service role referenced in client bundle | pitch-apps | API key exposure | high | open |
| F-103 | Table `sponsors` missing RLS policy | gameday-crm | Database | high | open |
| F-104 | Outdated dependency: axios 0.21 (CVE-2023-45857) | gameday-crm | Dependency | medium | open |
| F-105 | Missing CSP header on pitch microsites | pitch-apps | Headers | low | resolved |
| F-106 | HubSpot token rotated > 180 days ago | gameday-crm | Key hygiene | medium | open |
Endpoint health
crm.gamedayfanzone.us142ms · 99.98%
dashboard.gamedayfanzone.us188ms · 99.95%
blueprint.gamedayfanzone.us96ms · 100%
api.supabase (shared)61ms · 99.99%
pitch.bannerse.com912ms · 98.7%
stripe webhook relay220ms · 99.9%
Compliance checks
RLS enabled on all public tables
Secrets stored in vault (no plaintext)
HTTPS enforced on all domains
Dependabot enabled on all repos
2FA required for GitHub org
Auth cookie Secure + SameSite