What is different about this check
Review the live artefact and public platform references.
A secure repository does not guarantee a secure deployment. Build output can contain public environment values, source maps, old deploy domains, function paths, routing files, or security-header gaps. SiteGuardrail scans the public site without requesting Netlify account access and prioritises matching Netlify-related evidence in the free preview.
Finding a function path or netlify.app reference is not a vulnerability by itself. The surrounding route name, authentication assumptions, public configuration, and affected code determine the risk.
Deployment review
Five places to inspect before promoting production
Confirm every sensitive function enforces authorization server-side.
Keep secrets in protected function scopes and out of generated browser code.
Review auth callbacks, allowlists, cookies, and old deploy URLs.
Verify the live response, including content served by functions or proxies.
Keep configuration, backups, source maps, and debug files out of the publish directory.
Practical fixes
Apply the control where Netlify actually serves the response.
- Store sensitive function values in Netlify environment variables, restrict their scopes where available, and never inject them into client code.
- Treat every
/.netlify/functions/*route as a public API unless the function itself enforces authentication and authorization. - Use
_headersor Netlify configuration for static assets, but return required headers from a function or proxied origin when Netlify's static header rules do not apply. - Review rewrite rules for internal, admin, debug, staging, or third-party targets.
- Purge old public artefacts and rerun the checker after the new deploy.
Limitations
No Netlify account access means no private configuration audit.
SiteGuardrail cannot inspect team permissions, protected environment variables, private build logs, deploy settings, function source code, or whether every function correctly authorizes each operation. It reports only public deployment signals and wider passive findings. SiteGuardrail is independent and is not affiliated with Netlify.