Executive summary
No externally exposed data or private credentials were identified.
Bananafest Destiny reviewed withoutasking.com and its application subdomain, app.withoutasking.com, signed in as a test account made for this review, and inspected the supplied repository. The checks listed below produced no actionable security findings at the time of review.
Passed the listed checksThis result applies to the reviewed targets and source as they existed on 08 September 2026.
Review results
Checks performed
Public database access
The Supabase project behind withoutasking.com was tested directly with its public key against 41 common table names. Four tables exist; none returned a row.
HEAD requests and shallow counts, both domainsPrivate credentials
No service-role or private provider credentials were found in downloaded pages and JavaScript bundles, on either withoutasking.com or app.withoutasking.com.
Pages and public bundles, both domainsPublic files and source
No environment files, git metadata, or downloadable production source maps were found.
Targeted public-path requests, both domainsSigned-in browser session
A test account made for this review signed in and walked every screen of the real application — dashboard, week, meals, chores, shop, and individual meal pages. It never once queried the database directly from the browser: every read and write goes through the application's own server, so there was no client-side database key to test beyond the one used to sign in.
Real browser, signed in as a test account made for this reviewCurrent repository
No secret-shaped values or risky tracked environment files were found in the current source tree.
Bounded source scanRepository history
No secrets added and later removed were detected in the reviewed git history.
Latest 50 commitsMethod and scope
What this review covered
Public application
Same-origin pages, public scripts, database endpoints, exposed paths, credentials, and source maps, on both withoutasking.com and app.withoutasking.com.
Signed-in browser review
A test account made for this review signed in, and every screen of the real application was opened and observed — not just the pages a visitor with no account can reach.
Supplied repository
Current source, tracked environment files, configuration, and the latest 50 commits of git history.
Limitations
A dated review, not a permanent guarantee.
This report records the outcome of specific checks against a specific version of an application. It is not a penetration test and cannot guarantee that an application will remain free of security issues after it changes. The signed-in review used one test account and did not attempt to reach a second household's data — it confirms what that one account can see, not whether one household's data is isolated from another's, which is a different, deeper question this review does not answer.