More screenshots

    Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    Next.js + Supabase + Vercel Audit: Code, QA and Costs

    2

    Pre-launch security audit for Next.js + Supabase + Vercel: up to 13 review roles return verified findings with file:line evidence, fixes and cost drivers.

    $14

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    Security scanned
    Next.js + Supabase + Vercel Audit: Code, QA and Costs

    Next.js + Supabase + Vercel Audit: Code, QA and Costs

    Example session with this skill installed

    Audit ~/projects/tidepool, full mode. Here's my Vercel usage for the last 30 days: Image Optimization - Transformations 41,880 / 5,000 included, Function Invocations 212K, Fast Data Transfer 38 GB.

    • Read your context and instructions
    • Compiled the next js

    Full mode on tidepool (Next.js 15.3.2, App Router, 15 source files). 12 roles ran as parallel subagents; skipped qa-regression: no previous report.

    critical 3 | high 7 | medium 17 | low 10 · verification: 37 of 37 re-checked in a clean context, 37 confirmed, 0 dropped.

    Top 5 of 10

    1. SEC-1 | critical | OpenAI key in a NEXT_PUBLIC_ var | S | rotate the key, move the call to an authenticated server action
    2. SEC-2 | critical | deleteEntry without auth, via service role | XS | getUser() + author_id filter, drop the admin client
    3. DB-1 | critical | invoices table without RLS | S | enable RLS + owner-scoped select policy
    4. SEC-5 | high | cron route without CRON_SECRET | XS | Bearer CRON_SECRET check, 401 otherwise
    5. FV-1 | high | image optimizer open to any host | XS | restrict remotePatterns to the storage host and path

    Usage mapping: 41,880 transformations come from FV-1, the open hostname (next.config.ts:6), and FV-2, two formats x 11 widths (next.config.ts:8-9). Biggest lever: lock remotePatterns, then one format. Current prices: see the Vercel pricing page.

    Example finding

    DB-1 | critical | invoices table has no row level security

    • location: supabase/migrations/20260815120000_billing.sql:1
    • evidence: create table public.invoices (
    • why it matters: anyone holding the public anon key can read every invoice (customer_email, amounts) through the REST API
    • fix: alter table public.invoices enable row level security; plus a select policy scoped to the workspace owner
    • effort: S · confidence: confirmed · roles: database, security

    Files: audit-reports/audit-tidepool-2026-10-09-1730.md and .html, next to the repo.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    This skill audits an existing Next.js + Supabase + Vercel codebase the way a small review team would: five developer roles, five QA roles and three FinOps roles, each with a precise checklist.

    It detects your stack first and skips roles that don't apply. In Claude Code the roles run as parallel subagents; on claude.ai they run in grouped passes.

    Every finding has a severity, file:line, the quoted code, a fix and an effort estimate. Suspicions without evidence go to a separate "could not verify" list. A final verifier re-opens the cited lines in a clean context and drops anything the code doesn't show.

    Typical catches: tables without RLS, service-role keys in client components, secrets in NEXT_PUBLIC_ variables, server actions and cron routes without auth, wide image remotePatterns, missing indexes, N+1 queries, mobile Safari pitfalls, missing alt text.

    Paste your Vercel or Supabase usage page and the FinOps roles map each metric to the code behind it. The skill never quotes prices; it names the billing driver. Give it last month's report and it shows what was fixed, what is still open and what came back.

    Quick mode is fast and still thorough: the 5 core roles that catch the costliest problems (security, database, backend, frontend, Vercel costs), with every finding re-checked by the verifier. In a blind test on a repo the skill had never seen, quick mode caught 9.5 of 10 planted issues and full mode 10 of 10, with no false alarms. Full mode adds the QA, accessibility, i18n and remaining FinOps roles. Token cost, measured honestly on a small test repo: quick used about 0.5M subagent tokens and full about 1.1M. Larger repos cost more, so check your plan's limits before a full run.

    Output: a top-10 fix list, a markdown report and a self-contained HTML report. Read-only: it never edits code, runs migrations, calls any API or writes and runs scripts, and nothing from the skill is saved on your machine.

    After handover, if the client sends a list of small changes, Change Request Triage tells you which items are warranty fixes and which are paid.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean today

    • Passed all security checks, Safe to install

    Needs access to

    Valeria

    Listed3 days ago
    Updatedtoday

    What's inside

    Frequently Asked Questions