Read the report
report.md starts with a heading naming the app, the platform it was built on and the commit it was run on, followed by a one-line summary: how many findings there are at each severity, and how many checks found something, came back clean, did not apply, or could not assess.
Findings
Findings are grouped by severity, from critical to low. Each one has:
- A title and detail that say what was found and why it matters.
- Evidence: the file and line where it was found. Secret values are never copied into the report.
- Remedy: what to do about it. Remedies describe what to change, not which product to buy; the report names no vendor.
- An id, such as
supabase.rls.disabled.public.orders. Use it when you report a false positive.
| Severity | What it usually means |
|---|---|
| critical | Data or credentials are exposed now. Fix before anything else. |
| high | Anyone, or any signed-in user, can change data they should not, or a secret is probably shipped to the browser. |
| medium | Worth a decision: a table anyone can read, an open insert policy, or a dependency on the platform. |
| low | Clean-up that matters when you move or grow. |
Every check reports a result
A report lists every check, not only the ones that found something. Each check ends in one of four results:
| Result | Meaning |
|---|---|
| found | The check found at least one problem. It is listed under Findings. |
| clean | The check ran and found nothing. It is listed under Checked and clean. |
| not applicable | The check does not apply, for example the Supabase checks on an app without Supabase. |
| could not assess | The check could not give a complete answer, so it gives none, and says why. |
"Could not assess" is deliberate. When your tables were created in the Supabase dashboard rather than in migrations, or a migration uses dynamic SQL, a partial answer would look like a clean one. offramp would rather tell you it does not know.
Not visible from the repository
The report ends with the things no repository can show, such as policies changed in a dashboard, auth settings, backups and who has access, with where to check each one. See what offramp cannot see.
report.json
report.json has the same content for tools: app (name, platform, commit), summary (counts), findings, assessments (one per check, with its result and reason) and not_visible. The schema id is offramp.audit/1.