These are reproducible scans of intentionally vulnerable public training repositories—not customer incidents and not security guarantees. Each source link is pinned to a commit, every result says what Pallos checked, and every “after” result is a controlled re-scan.
Static source review onlyNo credentials stored or usedNo runtime attack performed
CASE 01
Wobblr
Deliberately vulnerable Next.js + Supabase + Stripe training app
Move privileged values and work to server-only code; verify the provider webhook signature against the raw body; add appropriate authentication, rate limits, and an output cap to the AI route; rotate any real credential that was ever exposed.
Important: The repository explicitly uses fake demo credentials. Pallos detected credential-shaped strings; this is not evidence that a live key was usable. The after result is a controlled remediation re-scan, not a claim that every runtime path was penetration-tested.
CASE 02
OWASP NodeGoat
OWASP’s intentionally insecure Node.js training application
Dynamic code execution in contribution calculations
Evidence: app/routes/contributions.js:31
Fix direction
Replace dynamic execution with explicit numeric parsing and validation. In this case, use a parser such as Number.parseInt only after validating the input’s allowed format and range.
Important: This focused static scan found one applicable dynamic-execution signal. It does not claim NodeGoat is otherwise safe—its purpose is to teach many vulnerability classes, some outside Pallos’s current checks.
CASE 03
Supabase Security Labs
Public lab intentionally demonstrating broken Supabase RLS
Replace broad policies with ownership or membership checks tied to auth.uid(), then test reads and writes with at least two accounts. The exact policy must match the application’s schema and authorization model.
Important: The controlled re-scan confirms the broad-policy pattern is gone. It does not prove the replacement policy is correct for every user or query; two-user runtime tests are still required.
How to read this
A score is a summary, not a promise.
Pallos reports only the checks it can apply from the available repository source. Untested areas remain untested, and a clean re-scan means the specific static pattern was no longer found—not that the app has no security risk.