Free Supabase security checker for Lovable, Bolt and Replit apps

    Paste your app's URL. In about 30 seconds it tells you whether a secret key is in your bundle, which tables anyone can read, and which buckets list their files, with the fix for each.

    The live address real users open, including your own domain if you have one.

    Read-only. Nothing is stored except counts.

    What it checks

    Every check uses only what a visitor's browser already receives, plus the same public requests your app makes to Supabase. Read-only, no login, no row contents.

    • Secret keys in the browser

      A Supabase service_role or sb_secret_ key, or a live Stripe, OpenAI, AWS or Resend key, shipped inside your JavaScript bundle. Anyone can read it from the developer tools.

    • Tables readable by anonymous visitors

      Row Level Security missing or too loose, so a request with the public key returns rows to anyone, signed in or not.

    • Storage buckets that list their files

      A public bucket whose policy lets anyone enumerate every file name, not just download a file they already have the link to.

    • Sign-up settings

      Whether sign-ups are open and whether email confirmation is required. Informational, so you can decide if that is what you intended.

    What it does not check

    It is a first look from the outside, not a security audit.

    • It is not a penetration test and does not try to exploit anything.
    • It never writes to your database or storage, so it cannot prove a table is writable. It gives you the SQL to check that yourself.
    • It does not log in, so it cannot see what a signed-in user of your app could reach.
    • It only finds tables and buckets named in your bundle. Tables your app never references are not tested.

    The two mistakes behind most leaks

    Supabase gives every project two kinds of key. The public one (anon, or the newer sb_publishable_) is meant to ship in your app and is only safe because Row Level Security decides what each request may see. The secret one (service_role, or sb_secret_) bypasses every rule and must never leave your server. AI builders sometimes put the wrong one in the front end.

    The second mistake is a table with RLS off, or a policy written as "allow everything" to make the preview work. The app runs fine, and anyone with the public key can read every row. Our guides walk through the fixes: Supabase Row Level Security for Lovable apps and securing Supabase storage buckets. If the app is a Lovable build, here is what usually breaks and how we fix it.

    Frequently Asked Questions

    Common questions about the checker

    Yes. The checker only reads what any visitor's browser already receives: your app's HTML and JavaScript, and the public Supabase endpoints your app itself calls with its public key. It never writes, never logs in and never reads the contents of your rows. It answers yes or no and counts.

    Only aggregate counts: when a run happened, which hostname was tested, how many checks failed and whether you ticked the ownership box, plus a hashed IP address for rate limiting. Keys found in your bundle are used in memory for that run and dropped. No row data, no file names, no secrets. If you ask for the report by email we keep that address.

    The checks work from the outside, the same way an attacker would. Your deployed app's bundle is where the Supabase project URL and public key live, and where a leaked secret key would be. A code repository would not show what is actually shipping to browsers.

    Each finding comes with a plain-English explanation and the fix, usually a few lines of SQL you can run in the Supabase SQL editor. If you would rather a person did it, the launch-readiness review is $149, credited to any fix you book within 60 days.

    Yes. A senior engineer reads your code and backend, writes up what blocks launch and gives you a fixed quote. Critical single fixes start at $249 and a full launch sprint from $1,299. Prices are on the pricing page.

    Terms of use

    Results are automated and are not a full security audit or a guarantee that an app is secure or insecure. The checker is for apps you own or have the owner's permission to test; by running it you confirm that. It makes read-only requests only, stores no row data, file names or keys, and keeps aggregate counts and a hashed IP address for rate limiting. AlgoSmiths SoftCom LLP accepts no liability for decisions made on the basis of these results. See the privacy policy and terms.