Catalog data
This page counts the issue guides published on ShipSecurely. It is not a count of breaches, victims, or how often these bugs occur in other people's apps.
Last updated
Entries by category and severity
22 issue guides. Entry dates in the files run from 2026-10-13 through 2026-10-14. 13 tool pages are published separately and are not in this table.
| Category | Entries | critical | high | medium |
|---|---|---|---|---|
| Access control | 5 | 3 | 2 | 0 |
| AI | 2 | 1 | 1 | 0 |
| Configuration | 3 | 0 | 1 | 2 |
| Database | 3 | 3 | 0 | 0 |
| Injection | 3 | 0 | 3 | 0 |
| Payments | 2 | 2 | 0 | 0 |
| Privacy | 1 | 0 | 0 | 1 |
| Secrets | 3 | 3 | 0 | 0 |
| All categories | 22 | 12 | 7 | 3 |
The entries behind the count
Access control
- Auth checked only in the UI · critical · updated 2026-10-13
- IDOR: reading or changing someone else's data · critical · updated 2026-10-13
- Server Actions with no auth check · critical · updated 2026-10-13
- No rate limiting on auth or paid API routes · high · updated 2026-10-13
- Weak password reset · high · updated 2026-10-13
AI
- No cap on LLM API spend · critical · updated 2026-10-13
- Prompt injection in LLM features · high · updated 2026-10-13
Configuration
- CORS wide open · high · updated 2026-10-13
- Missing security headers · medium · updated 2026-10-13
- Outdated dependencies · medium · updated 2026-10-13
Database
- Firebase rules left open · critical · updated 2026-10-13
- Open storage buckets · critical · updated 2026-10-13
- Supabase tables without row level security · critical · updated 2026-10-13
Injection
- Cross-site scripting (XSS) · high · updated 2026-10-13
- SQL injection · high · updated 2026-10-13
- Unsafe file uploads · high · updated 2026-10-13
Payments
- The client sets the price, role, or plan · critical · updated 2026-10-13
- Unverified Stripe webhooks · critical · updated 2026-10-13
Privacy
- Missing privacy policy and terms · medium · updated 2026-10-14
Secrets
- Exposed .env files and debug endpoints · critical · updated 2026-10-13
- Keys committed to GitHub · critical · updated 2026-10-13
- Secret keys shipped in the frontend · critical · updated 2026-10-13
Methodology
Each published issue guide is one entry. The unpublished template is not counted.
Category and severity are the labels on each guide. They are editorial, and they are defined on the issues index. They are not a count of observed attacks.
The table is built from the published guides. Recount by opening the guides linked above. Tool pages are a separate directory and are not added into the issue totals.
Nothing on this page estimates how often a bug appears in the wild, how many apps are vulnerable, or how much money was lost.