Is your Supabase app readable by anyone?
Apps built with Lovable, Bolt, Replit, Cursor or Claude often ship with a table anyone can read. Check what your site shows the world, then walk through the one check that matters, inside your own Supabase account.
Your data stays where it is.
How this check works.
- It reads the page you name and up to six of your site’s own scripts: the same files every visitor’s browser receives. Size-capped, and it never follows your site to another address.
- It never sends a request to your database or to your Supabase project. Whether a table is readable is decided by Row Level Security and the table grants inside your account, which no outside check can see. That is why the steps take you to Supabase’s own Security Advisor.
- A secret key is reported by its kind only, never shown and never stored, and only to the person who just put a one-time code on the site.
- We keep anonymous counts of checks for our own numbers and for the monthly State of AI-Built App Security: whether Supabase was found, and a key’s kind only for a proven owner. Never the address, the project or the key.
Supabase’s own guides: the Security Advisor, Row Level Security, publishable and secret keys.
More checks of your live app: the app security check and 7IT Guard.
Launch Review
Your AI built it. Nobody checked it. I will.
A senior engineer goes through your live app and tells you what is leaking, what is broken and what to fix first, with the exact prompt that fixes it. Written report in 48 hours.
- Fixed price
- Database rules, keys, payments, email
- Money back if nothing needs fixing