Vallit
Sign inGet started
Nine colossal monoliths in a line under a pale blue sky, one small figure at the foot of the tallest.

Release1.15.68

The whole perimeter

Nine new checks for everything around your code: database rules, the libraries you install, keys left in your repository, and the domain your email and your customers trust.

Everything Vallit checks

Vallit now runs 29 checks, from the address a visitor types to the repository behind the app. The nine new ones watch the parts your own code never shows: the rules in your database, the libraries you install, what sits in your repository, and the domain your email comes from.

Checked from outsideRead in your codeNewIn this release

  1. Your address

    Domain renewal

    Is your domain registration close to expiring?

  2. Your pages

  3. Left in public

  4. Your API

  5. Your server

  6. Your data

  7. Your repository

Nine new checks at the edges

Each one reads something a stranger can reach or an attacker will look up first, and points at the exact line where it gives way. Everything stays read-only: the website checks ask what any browser may ask, the repository checks read files and never run them.

Your data

Your libraries

Your repository

Your domain and email

supabase/migrations/20260114093000_todos.sql
create table public.todos (  id uuid primary key default gen_random_uuid(),  user_id uuid references auth.users not null,  title text not null);alter table public.todos enable row level security;create policy "Allow all" on public.todos  for all using (true) with check (true);

Where it gives way

HighRead in your code

Anyone can change or delete data without signing in

What can happen
A stranger rewrites or wipes every todo from their own browser, with the public key every visitor already has.
How to fix it
Replace the rule with owner rules: signed-in users, and only rows where auth.uid() matches user_id.

How well it works

Two writers who had never seen the checks built 54 small cases each: 27 with a real problem, and 27 safe ones that only look like one. We tested against set 1 first and fixed the three gaps it showed. Set 2 stayed closed until then and was scored once; it showed two more, which this release fixes too. Both first scores stay on the chart as they were.

Issues found

The nine new checks

Our bar 90%

Alert accuracy

The nine new checks

Our bar 90%

Check by check, both sets as shipped
CheckFoundWrong
Database rules100% 6 of 60
Sign-up settings100% 6 of 60
File storage100% 6 of 60
Vulnerable libraries100% 6 of 60
Libraries on your pages100% 6 of 60
Committed secrets100% 6 of 60
Email in your name100% 6 of 60
Domain renewal100% 6 of 60
Forgotten subdomains100% 6 of 60

What these numbers don’t say

  • The cases are small examples, not your app. Six per check are enough to catch a broken rule, not enough for a promise.
  • What the public registries say (the vulnerability database, DNS, the domain registry, the certificate logs) is written into each case and replayed, so the run tests our reading of their answers, not the registries themselves.
  • A library with a known flaw is reported by its version. Whether your app reaches the flawed part is something a version number cannot tell.

Also in this release

  • What we checked has a fifth groupWhat your repository carries lists the library and secret checks when a repository is connected.
  • Only what a lookup needsLibrary lookups send a package name and version, domain lookups send the domain name, and nothing touches your app.
  • Platform addresses are left outApps on addresses like vercel.app skip the email and domain checks, because those records belong to the platform.
  • Reduced motion shows the list at onceWith reduced motion switched on, What we checked and its seal appear at once instead of fading in over three seconds.
Every change since 1.0