ChecksOut

Sample report · a made-up app, to show what a ChecksOut report looks like

Security review · Inspected November 7, 2026

Pantry Pal

A made-up meal-planning app, used here to show what a ChecksOut report looks like.

The ChecksOut badge for Pantry Pal: Sample report, not a real review
The badge on the app
  • 7Passed
  • 0Issues open
  • 1Not checked
  • 1Not applicable

Sample report, not a real review

Real reports read the same way: what we checked, what we found, and what we didn’t look at.

Reviewed
November 7, 2026
Valid until
February 5, 2027
Version reviewed
Web app, release of November 6, 2026 (commit 4f2a9c1)
Who reviewed it
ChecksOut’s automated review. No person reviewed this app.

Your payment details

Where your card number goes when you pay.

  • Card details go to the payment provider

    Passed

    Card details are typed into Stripe's hosted checkout page. Pantry Pal's servers don't receive your full card number.

    Show evidence

    What we found

    Checkout page
    The yearly-plan button opens checkout.stripe.com. Card fields load from Stripe, not from example.com.
    Network
    During a test checkout, no request to example.com contained a card number, expiry date or security code.
    Code
    No card-number fields or columns exist in the code or database schema. The app stores only Stripe’s customer and subscription IDs.

    How we checked

    • Tested from outside
    • Code read

    What this doesn't tell you

    This covers how the app handles your card. It doesn't review the payment provider itself or what the developer charges.

Your account and personal data

Whether other people can get at what you store in the app.

  • Other users can't reach your private data

    Passed

    Signed in as two separate test users, neither could read or change the other's saved recipes, lists or settings.

    Fixed during review

    Show evidence

    What we found

    Tested
    14 data requests were repeated as a second user with the first user’s IDs. None returned or changed the first user’s data.
    Fixed during review
    The first run found that shared-list links could be guessed. The developer switched to unguessable links, and the recheck passed.
    Code
    Row-level security is on for all 6 tables, each tied to the row’s owner.

    How we checked

    • Tested with two accounts
    • Code read

    What this doesn't tell you

    Covers the features and data types that existed on the review date, tested with two ordinary accounts. It doesn’t cover staff or admin accounts.

  • The database is locked to outsiders

    Passed

    Requests sent straight to the database without signing in were turned away, except for the public recipe gallery, which is meant to be public.

    Show evidence

    What we found

    Tested
    All 6 tables were tried with the public key. Only published gallery recipes were readable. No writes succeeded.

    How we checked

    • Tested from outside
    • Code read

    What this doesn't tell you

    Covers the database as configured on the review date. It doesn't cover backups or the hosting company's own systems.

Your device

Whether the app asks for more access to your computer or phone than it needs.

  • Nothing to install on your device

    Passed

    Signing up and using Pantry Pal needed no downloads, browser extensions or system permissions.

    Show evidence

    What we found

    Tested
    Sign-up, saving recipes, sharing a list and checkout were used start to finish. No download or install prompt appeared.

    How we checked

    • Tested from outside

    What this doesn't tell you

    Covers sign-up and the main features on the review date. Where a bot check stopped the review, sign-up was followed up to the bot check. A browser’s own update prompts aren’t part of the app.

  • Camera, microphone and location only when needed

    Not applicable

    Pantry Pal doesn't ask for camera, microphone or location access.

    Show evidence

    What we found

    Code and testing
    No permission requests were found in the code or seen during testing.

    How we checked

    • Tested from outside
    • Code read

    What this doesn't tell you

    Covers what the app asks for. It can’t see what happens after you say yes beyond the review’s tests.

  • Outside code on the page is listed

    Passed

    Three outside services load code into Pantry Pal: Stripe for payments, Vercel Analytics for page counts, and Google for sign-in.

    Show evidence

    What we found

    Recorded
    Scripts from js.stripe.com, va.vercel-scripts.com and accounts.google.com. No unidentified scripts.

    How we checked

    • Tested from outside

    What this doesn't tell you

    Lists outside code seen on the review date. Outside services can change their own code later.

Behind the scenes

The basics that protect everyone using the app.

  • No secret keys left in the open

    Passed

    No private keys or passwords were found in Pantry Pal's public pages, code bundle, or source code history.

    Fixed during review

    Show evidence

    What we found

    Live site
    Code bundles and common leftover files (.env, .git) were checked. Only the public database key, which is meant to be public, was present.
    Fixed during review
    An old commit contained a database password inside a saved AI coding-tool command. The developer replaced the password and removed the file from history before the recheck.

    How we checked

    • Tested from outside
    • Code read

    What this doesn't tell you

    Covers what was readable on the review date. It can't tell whether a key leaked somewhere else before.

  • Your connection is encrypted

    Passed

    Every page is served over HTTPS, and browsers are told to always use it.

    Show evidence

    What we found

    Tested
    http:// redirects to https://. Strict-Transport-Security is set for one year.

    How we checked

    • Tested from outside

    What this doesn't tell you

    Covers the app's own web addresses. It doesn't cover other sites the app links to.

Your privacy

Whether the app is upfront about what it collects.

  • The privacy policy matches what the app collects

    Not checked

    Pantry Pal's privacy policy was still being written on the review date, so this wasn't checked.

    Show evidence

    No evidence was collected for this check.

    How we checked

    • Tested from outside
    • Code read

    What this doesn't tell you

    Compares the policy with what we saw. It isn't legal advice and doesn't check whether the developer follows the policy later.

Outside services seen

Other companies whose code loaded while we used the app.

  • StripePayments
  • Vercel AnalyticsCounting page views
  • GoogleContinue with Google sign-in
What we looked at
  • The live web app at example.com
  • Sign-up, sign-in, saving recipes, sharing a list, and paying for the yearly plan
  • Source code shared read-only through GitHub, including its full history
What we didn't look at
  • The iPhone and Android apps
  • Staff and admin tools
  • The hosting company, payment provider and sign-in provider themselves
  • Anything changed after the review date

How to read this report

  • Passed means we found the evidence listed for that check. It describes this version on this date, not what the app might do later.
  • Issue found means we found a problem that wasn’t fixed before the report was published.
  • Not checked means we couldn’t gather the evidence, so we make no claim either way.
  • Not applicable means the check doesn’t fit this app, like a payment check for a free app.

No review can promise an app is free of problems. See every check and what it needs.