Seo CLI

Licence and provenance

finding

no LICENCE file at the root (.)

Tool description integrity

nothing to read

Pattern set 1.0 matched nothing on 2026-10-01, but none of the descriptions the package ships runs to 120 characters, so there was little for a rule to read.

It reads the descriptions the package ships, not what the server says when it runs, and a clean description is not the same thing as a safe tool.

Row-level security

nothing to read

No Supabase migrations in the 7 files of the published package read on 2026-10-02, so there was nothing for this check to read.

Not covered: A reading of files cannot prove a policy is enforced at run time: whether these migrations were applied, whether row-level security was switched on another way (the dashboard, SQL run by hand), or what a table holds. A database only the app's own server can reach (SQLite, or Postgres behind a server that holds the only connection) needs no row-level security for this reason, and its migrations are not read.

Object-level authorisation

nothing to read

No Supabase migrations in the 7 files of the published package read on 2026-10-02, so there was nothing for this check to read.

Not covered: Whether the app means every account to edit everything (an admin tool whose only account is its owner's), whether sign-up is open (a dashboard setting), and anything about a policy whose expression looks at the row. Whether the migrations were applied is not known. Policies that let anyone read every row are not counted here.

CORS configuration

no match, 6 code files read

App check set 1.0 matched nothing across 6 code files, 7 files of the published package read on 2026-10-02.

Not covered: Whether it matters. A server that checks a token sent in a header gives a foreign page nothing it could not do without the browser, and a server bound to the loopback address is reachable only from pages open on the same machine (which is still every page that machine opens). A value chosen at run time, such as a variable that falls back to *, is not read: the hand count found one such server, and it is not in the figure.

Not covered: Whether the server reads cookies at all, whether the echo is guarded by a check this reading does not follow, and anything decided at run time.

No shipped credentials

no match, 7 files read

App check set 1.0 matched no credential in a format it recognises, bundles included, across the 7 files of the published package read on 2026-10-02.

Not covered: Whether a key still works (none is ever tried, because trying one would be using it), credentials in formats the check does not name, anything in a repository's history, and files the nightly reading does not reach when a package is over its caps.

Published because it was found. A finding is information about where the limits are, not a verdict that the software is unsafe.