What access we need

Before you start

Wherever a platform asks who to invite, invite contact@putthrough.com. Choose the lowest role that can view. If a platform only offers roles that can change things, use the alternative listed for it instead.

Never send passwords, API keys, service-role keys, .env files or customer data, by email or anywhere else. An audit does not need them.

Code

One of these:

• GitHub, repository owned by an organization: Settings → Collaborators and teams → Add people, with the Read role
• GitHub, repository on a personal account: personal repositories have no read-only role, so download the code (Code → Download ZIP) and share the file through a link, or move the repository into a free organization and use the step above
• GitLab: invite us to the project as a Reporter, which can read the code but not push to it
• Bitbucket: Repository settings → Repository permissions, with Read
• Lovable, Bolt, Replit or v0: connect the project to GitHub first (each has a GitHub sync or export), then use the GitHub step

Database

One of these, for the database your app uses:

• Supabase: Organization settings → Team → Invite, with the Read-only role. If your plan doesn’t offer Read-only, don’t choose a higher role; run supabase db dump -f schema.sql and send us the file instead. It holds your tables, policies and grants, but no data
• Firebase: Project settings → Users and permissions → Add member, with the Viewer role
• Neon, plain Postgres or anything else: send a schema-only dump (pg_dump --schema-only), which holds no data

Hosting

One of these:

• Vercel: Team settings → Members → Invite, as a Viewer if your plan has that role
• Any other host, or a plan without a view-only role: send the names of your environment variables (names only, never the values) and screenshots of your domain and access-protection settings

Mobile apps

Only for a web + mobile audit:

• iOS: add us as a TestFlight tester for the build you plan to submit
• Android: Play Console → Users and permissions → Invite, with the read-only View app information permission, and add us as a tester on your internal testing track

Two test accounts

Create two ordinary user accounts in your app, not real customers, so we can check that one user cannot see or change the other’s data. If your app has roles such as admin and member, make one of each.

Share their sign-ins through a one-time secret link (onetimesecret.com is free), not in a plain email.

When we finish

When the report is delivered, remove our access everywhere you added it. The delivery email lists each place, so nothing is left behind.