What offramp cannot see
A repository is not the running app. offramp reads files as they are now, so a clean report says nothing about settings that live somewhere else. Every report ends with this list, adjusted to your app. Check each item yourself.
Every app
| What | Why the audit cannot see it | Where to check |
|---|---|---|
| Settings made in the platform's dashboard | Environment variables, secrets and domains configured outside the repository. | Review them in the platform's project settings. |
| Git history | A secret removed in a later commit is still in the history. | Run a history-wide secret scanner, for example gitleaks or trufflehog. |
| Who has access | Members of the platform account, collaborators on the repository, and anyone with database dashboard access. | List them, and remove anyone who no longer needs access. |
| Backups | Whether the database is backed up, and whether a restore has ever been tested. | Check the database provider's backup settings and do one test restore. |
Apps that use Supabase
| What | Why the audit cannot see it | Where to check |
|---|---|---|
| Row-level security changed in the dashboard | Policies created in the dashboard never appear in supabase/migrations/. | Run the Security Advisor in the Supabase dashboard and fix what it reports. |
| Auth settings | Whether anyone can sign up, whether email confirmation is required, and which redirect URLs are allowed. | Review Authentication settings. Open sign-up makes every authenticated policy effectively public. |
| Storage bucket policies | Which buckets are public and who can upload. | Review Storage policies in the Supabase dashboard. |
Apps that use MongoDB
| What | Why the audit cannot see it | Where to check |
|---|---|---|
| Database network access | Whether the instance accepts connections from any address. | Restrict network access to the addresses your backend runs from. |