Pallos Proof Lab

Real detections. Public source. Clear limits.

These are reproducible scans of intentionally vulnerable public training repositories—not customer incidents and not security guarantees. Each source link is pinned to a commit, every result says what Pallos checked, and every “after” result is a controlled re-scan.

Static source review onlyNo credentials stored or usedNo runtime attack performed

CASE 01

Wobblr

Deliberately vulnerable Next.js + Supabase + Stripe training app

Source at 902eef5
Original scan39/100Critical Risk

77% applicable-check coverage

Controlled re-scan95/100Strong

77% applicable-check coverage

What Pallos flagged

  • Credential-shaped demo values in source
  • Unprotected AI route
  • Webhook without visible signature verification
  • Supabase service-role key referenced from client code

Evidence: .env.example · app/api/ai/describe/route.ts · app/api/stripe/webhook/route.ts · app/dashboard/page.tsx

Fix direction

Move privileged values and work to server-only code; verify the provider webhook signature against the raw body; add appropriate authentication, rate limits, and an output cap to the AI route; rotate any real credential that was ever exposed.

Important: The repository explicitly uses fake demo credentials. Pallos detected credential-shaped strings; this is not evidence that a live key was usable. The after result is a controlled remediation re-scan, not a claim that every runtime path was penetration-tested.

CASE 02

OWASP NodeGoat

OWASP’s intentionally insecure Node.js training application

Source at c5cb68a
Original scan84/100Moderate Risk

50% applicable-check coverage

Controlled re-scan95/100Strong

50% applicable-check coverage

What Pallos flagged

  • Dynamic code execution in contribution calculations

Evidence: app/routes/contributions.js:31

Fix direction

Replace dynamic execution with explicit numeric parsing and validation. In this case, use a parser such as Number.parseInt only after validating the input’s allowed format and range.

Important: This focused static scan found one applicable dynamic-execution signal. It does not claim NodeGoat is otherwise safe—its purpose is to teach many vulnerability classes, some outside Pallos’s current checks.

CASE 03

Supabase Security Labs

Public lab intentionally demonstrating broken Supabase RLS

Source at 3888990
Original scan69/100High Risk

62% applicable-check coverage

Controlled re-scan95/100Strong

65% applicable-check coverage

What Pallos flagged

  • RLS policies with an unconditional using (true) expression

Evidence: rls-broken-lab/supabase/migrations/20260304090100__lab_broken_rls_and_storage.sql:24

Fix direction

Replace broad policies with ownership or membership checks tied to auth.uid(), then test reads and writes with at least two accounts. The exact policy must match the application’s schema and authorization model.

Important: The controlled re-scan confirms the broad-policy pattern is gone. It does not prove the replacement policy is correct for every user or query; two-user runtime tests are still required.

How to read this

A score is a summary, not a promise.

Pallos reports only the checks it can apply from the available repository source. Untested areas remain untested, and a clean re-scan means the specific static pattern was no longer found—not that the app has no security risk.

Read the methodology

Ready to check your own code?

Get the evidence before you launch.

Start a private beta scan