How the roll-up gate works
How the Browser Line Read-Off gate works
This tool grades each check in your app on whether the browser could simply bypass it. It reads 10 checks and rolls them into one verdict — the worst, never the average — then a gate that can only make it worse.
The 10 checks
01C-01 · Signed in before the dashboard opensserver-side · guards others' dataENFORCED
02C-02 · Amount charged at checkoutfix firstmoneyTRUSTS THE BROWSER
03C-03 · Prices shown on the pricing pagebrowser-side · own convenience onlyFINE IN THE BROWSER
04C-04 · Discount code is valid and unusedserver-side · guards moneyENFORCED
05C-05 · Admin panel accessorigin could not be found → scored as browser-suppliedTRUSTS THE BROWSER
06C-06 · Only the owner can open a saved recordlocation could not be found → scored as browserTRUSTS THE BROWSER
07C-07 · Only the owner can edit a saved recordserver-side · guards others' dataENFORCED
08C-08 · Free-tier usage limitbrowser-side · guards moneyTRUSTS THE BROWSER
09C-09 · Which nav items are visiblebrowser-side · own convenience onlyFINE IN THE BROWSER
10C-10 · Upgrade banner hidden for paying usersbrowser-side · own convenience onlyFINE IN THE BROWSER
LINE HOLDS
nothing that matters is left to the browser
LINE LEAKS
something that matters trusts the browser
NO LINE
a money check trusts the browser
Moved-but-still-trusting · worsen-only
Server-side code that decides from a value the browser sent is still a browser-side decision. The code moved; the trust did not. An observation you could not find resolves to the unsafe side — you get no credit for a wall you cannot locate.
NO LINEWhy: Four of ten checks trust the browser, and one of them guards money — so the line does not hold anywhere it counts. Two of those four sit in server-side code and still failed: they decide from a value the browser handed them. Three more are browser-side on purpose and never count against you. 4 of 10 trust the browser · 2 moved but still trusting · worst-not-average.
Fix firstC-02, the amount charged at checkout — it runs server-side but decides from a value the browser sent, and it guards money
No single check is the crisis — the clustering is. The roll-up takes the worst, the gate escalates when trouble compounds, and it names the one thing to fix first. Grades how an app is built, never a person. Not a scanner, a penetration test, or a code audit — it reads back what you tell it, using rules you can see.
RedHub AI