Run your connected backend audit

The SimplyScan Security Engine’s connected audit checks explicitly configured backend resources using your own project keys. Run it only against a project you own and dedicated disposable test data. It runs on your computer; credentials are read from environment variables and never included in the report.

Download the audit (.mjs) · Node 20 or newer · no install step. Checksum file

SHA-256: 6c50a0551c8e9d761ac36d35d5a39b782997a76642c36947ab29be63d870d102

What it tests

For each configured resource, it tests read, create, update and delete access as an anonymous visitor, the owner and a second user: twelve permission checks. With ownershipTests enabled, it also checks reverse isolation and attempts to transfer ownership in both directions. Results compare observed access with the permissions you declare. Supported adapters include Supabase, MongoDB, Firebase RTDB, Firestore, Appwrite, PocketBase, GraphQL and explicitly configured HTTP APIs.

Configure your project

Save the following as config.json. Replace the URL, resource and user IDs with your own. Credentials fields contain environment-variable names, never key values. For Supabase, use a dedicated table with a text primary key named id, an owner_id field and an audit_marker field, plus your intended row-level policies. Use the project’s public key, an administrative key for canary setup/cleanup, and two distinct signed-in users’ access tokens. Do not use administrative keys as user tokens.

{
  "version": 1,
  "siteUrl": "https://your-site.example",
  "authorizedTestEnvironment": true,
  "targets": [
    {
      "name": "private_records",
      "provider": "supabase",
      "endpoint": "https://YOUR_PROJECT.supabase.co",
      "resource": "audit_fixture",
      "ownerId": "REPLACE_WITH_TEST_USER_ID",
      "ownerField": "owner_id",
      "canaryField": "audit_marker",
      "credentials": {
        "admin": {
          "env": "AUDIT_ADMIN_TOKEN"
        },
        "owner": {
          "env": "AUDIT_OWNER_TOKEN"
        },
        "other": {
          "env": "AUDIT_OTHER_TOKEN"
        }
      },
      "expected": {
        "anonymous": {
          "read": false,
          "create": false,
          "update": false,
          "delete": false
        },
        "owner": {
          "read": true,
          "create": true,
          "update": true,
          "delete": true
        },
        "other": {
          "read": false,
          "create": false,
          "update": false,
          "delete": false
        }
      },
      "otherId": "REPLACE_WITH_SECOND_USER_ID",
      "ownershipTests": true,
      "publicKeyEnv": "AUDIT_PUBLIC_KEY"
    }
  ]
}

Set AUDIT_PUBLIC_KEY, AUDIT_ADMIN_TOKEN, AUDIT_OWNER_TOKEN and AUDIT_OTHER_TOKEN in your local shell. Set expected permissions for your actual policy. Each target name/resource must be explicit; the audit does not discover or modify arbitrary tables. Other adapter configuration examples are in scripts/backend-audit in the repository. MongoDB username/password authentication is bundled; optional native enterprise authentication/compression plugins are not included.

shasum -a 256 simplyscan-backend-audit.mjs
node simplyscan-backend-audit.mjs config.json --allow-disposable-writes --output report.json

Writes and cleanup

The explicit --allow-disposable-writes flag is required. The audit creates randomly identified canary records, reads them, updates them, tests deletion and ownership changes, and uses administrative credentials to clean up only its own canaries. It does not change schema or policies. It verifies cleanup and lists leftover IDs if cleanup fails. Review those IDs and remove leftover test records yourself. Interrupting the audit requests cleanup; killing the process or losing network access can prevent it. Use a fresh output filename: existing reports are never overwritten.

Read and attach your report

The terminal prints per-check results and writes report.json with private permissions. Exit 0 means the configured checks passed; 1 means failed or incomplete checks, and 2 means setup or execution failed. Sign in, open your scan report and use “Attach audit JSON to this scan”. Attachments are visible only to their owner and can be removed. They are labelled owner-run evidence and do not change the public scan score. Policy snapshots and a passing configured matrix do not prove that every resource or rule is secure.