🔒 Padlock

Database & backend security auditor — lock down your data layer.

Padlock audits the part most security tools miss: your database configuration, access controls, migrations, and infrastructure security. It detects missing RLS, exposed service keys, dangerous migrations, PII without protection, and more.

Quick Start

npx padlock-cli audit .

That's it. Padlock auto-detects your database stack and scans for security issues.

What It Catches

| Category | Severity | Examples | |----------|----------|---------| | Access Control | CRITICAL | Missing RLS, no policies, anon write access | | Migration Safety | HIGH | DROP TABLE, TRUNCATE, numbering gaps | | Data Protection | HIGH | PII columns, plaintext passwords | | Connection Security | HIGH | SSL disabled, hardcoded connection strings | | Key Management | CRITICAL | Service role key in client code, public env vars | | Query Safety | MEDIUM | SQL injection, unbounded SELECT, SELECT * | | Realtime Security | MEDIUM | Unfiltered subscriptions, broad access | | Storage Security | MEDIUM | Public buckets, long-lived signed URLs | | Environment Hygiene | HIGH | .env in git history, missing .gitignore | | LLM Infrastructure | CRITICAL | Exposed Ollama, API keys in client code |

CLI Usage

# Auto-detect stack, scan project
padlock audit .

# Force a specific stack
padlock audit . --stack supabase

# JSON output for CI/automation
padlock audit . --format json

# Filter by severity
padlock audit . --severity critical

# CI mode — exit code 1 if critical findings
padlock audit . --ci

Example Output

🔒 Padlock v0.1.0

Stack: supabase (Found dependency: @supabase/supabase-js)
Detected: 7 tables, 9 migrations

Padlock Score: 42/100 (F)

🔴 CRITICAL
  [AC-1] No RLS on table: access_grants
  [AC-1] No RLS on table: conversations
  [KM-1] Service role key used in client-facing code: src/lib/db.ts

🟠 HIGH
  [AC-2] RLS enabled but no policies on table: waitlist
  [EH-1] Deleted .env file found in git history: .env.prod

🟡 MEDIUM
  [DP-1] PII column detected: waitlist.email
  [QS-2] Potentially unbounded SELECT in app/api/route.ts:45

5 critical · 2 high · 3 medium

Scoring

| Grade | Score | Meaning | |-------|-------|---------| | A | 90-100 | Solid security posture | | B | 80-89 | Good, minor improvements needed | | C | 70-79 | Fair, several issues to address | | D | 60-69 | Poor, significant gaps | | F | <60 | Critical issues need immediate attention |

Deductions:

• Critical: -15 points
• High: -10 points
• Medium: -5 points
• Low: -2 points

Supported Stacks (v0.1)

• ✅ Supabase — Full support (RLS, policies, migrations, storage, realtime)

Coming soon: PostgreSQL, Prisma, Drizzle, MongoDB, Firebase, PlanetScale, Redis

Rule IDs

| ID | Category | Description | |----|----------|-------------| | AC-1 | Access Control | No RLS on table | | AC-2 | Access Control | RLS enabled but no policies | | AC-3 | Access Control | Anon role has write access | | AC-4 | Access Control | Overly permissive policy (USING true for write) | | AC-5 | Access Control | Anon broad read on sensitive table | | MS-1 | Migration Safety | Destructive operation (DROP, TRUNCATE) | | MS-2 | Migration Safety | Migration numbering gap | | MS-3 | Migration Safety | Foreign key without ON DELETE | | MS-4 | Migration Safety | No index on foreign key column | | DP-1 | Data Protection | PII column detected | | DP-2 | Data Protection | Possible plaintext secret storage | | CS-1 | Connection Security | SSL disabled | | CS-2 | Connection Security | Hardcoded connection string | | CS-3 | Connection Security | Service bound to 0.0.0.0 | | KM-1 | Key Management | Service role key in client code | | KM-2 | Key Management | Secret key in NEXT_PUBLIC_ env var | | KM-3 | Key Management | Hardcoded fallback secret | | QS-1 | Query Safety | SQL injection risk (string interpolation) | | QS-2 | Query Safety | Unbounded SELECT | | QS-3 | Query Safety | SELECT * in production code | | RT-1 | Realtime Security | Subscription on broadly accessible table | | RT-2 | Realtime Security | Subscription without filter | | RT-3 | Realtime Security | Realtime enabled without table restrictions | | SS-1 | Storage Security | Public storage bucket | | SS-2 | Storage Security | Cloud storage URL in source | | SS-3 | Storage Security | Signed URL with long expiration | | EH-1 | Environment Hygiene | Deleted .env file in git history | | EH-2 | Environment Hygiene | .gitignore missing .env patterns | | EH-3 | Environment Hygiene | No .env.example file | | EH-4 | Environment Hygiene | .env file tracked in git | | LLM-1 | LLM Infrastructure | LLM service on public interface | | LLM-2 | LLM Infrastructure | LLM API key in client code | | LLM-3 | LLM Infrastructure | LLM key in NEXT_PUBLIC_ env var | | LLM-4 | LLM Infrastructure | System prompts in unprotected table |

Development

# Install dependencies
npm install

# Build
npm run build

# Run tests
npm test

# Dev mode
npx tsx src/index.ts audit /path/to/project

License

MIT