What a complete report looks like

Revoke the key immediately at platform.openai.com/api-keys — not later; the old one is irreversibly public.

Then: the call belongs on the server, not in the browser. Add your own route (an edge function or /api/chat) that holds the key server-side and forwards the request. The frontend then only calls your route.

`dangerouslyAllowBrowser: true` is the SDK telling you this path was never intended.

In the Supabase console under Authentication → Policies for the `profiles` table:

```sql
ALTER TABLE profiles ENABLE ROW LEVEL SECURITY;

CREATE POLICY "Read own profile"
  ON profiles FOR SELECT
  USING (auth.uid() = id);

CREATE POLICY "Update own profile"
  ON profiles FOR UPDATE
  USING (auth.uid() = id);
```

Note: `ENABLE ROW LEVEL SECURITY` on its own blocks everything — without a policy your own app loses access too. The two belong together.

Then scan again — this check is the proof that it worked.

In `vite.config.ts`:

```ts
export default defineConfig({
  build: { sourcemap: false },
});
```

For Next.js: `productionBrowserSourceMaps: false` (that is already the default — check whether something set it to `true`).

Then rebuild and redeploy. Delete existing `.map` files on the server: a new build does not necessarily remove them.

A starting point for a typical SPA:

```
Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'
```

Roll it out as `Content-Security-Policy-Report-Only` first and watch the browser console for what would be blocked. Only switch to the enforcing header once nothing important shows up.

Add the header:

```
Referrer-Policy: strict-origin-when-cross-origin
```

This is what modern browsers already default to — setting it explicitly makes the behaviour independent of the visitor’s browser.

Add a TXT record with the name `_dmarc`:

```
v=DMARC1; p=none; rua=mailto:dmarc@beispiel-app.de
```

Start with `p=none` — it rejects nothing yet but collects reports on who sends in your name. Once the reports look clean, move to `p=quarantine` and later `p=reject`.

Starting at `p=reject` can make your own mail from newsletters or billing systems undeliverable.

Nothing to do. We list it because it determines which checks we run for you — and because you should know what is visible about your setup from the outside.