for Supabase apps

Is your Supabase service_role key exposed?

No signup 路 no repo or GitHub access needed 路 passive, read-only checks 路 results in under a minute

See a sample report

The anon key is meant to be public. The service_role key is not. Paste your link and we'll check which one your site ships. Under a minute, no sign-up.

Only scan apps you own or have permission to scan.

why.txt

anon key vs service_role key

Your Supabase anon key is designed to live in the browser. Row Level Security decides what it can do.

The service_role key skips Row Level Security completely. If it's in your frontend, anyone who finds it has full access to your database.

what_we_check.log

What the free scan checks

  • Supabase service_role key

    A Supabase service_role key in your client code is flagged as critical. That key skips Row Level Security entirely.

  • Open tables (owner opt-in)

    If you use Supabase, tick the extra box and we ask 15 common table names (like users, profiles, orders) for 1 row using your public anon key. Row contents are never stored or shown.

  • Leaked keys in your frontend

    Your page HTML and up to 15 of your own JavaScript files are checked for Stripe live secret and restricted keys, OpenAI, Anthropic, AWS, GitHub, Slack and Resend keys, Google API keys and private key blocks. Anything found is masked in the report.

  • Files left on the server

    Things like /.env, /.env.local, /.env.production, /.git/config, .npmrc, docker-compose.yml, backup files, and package.json or lockfiles.

  • Security headers and CORS

    HSTS, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and wildcard CORS with credentials.

checklist.txt

If your service_role key is exposed

  1. Rotate it now. Rotate the key (or JWT secret) in your Supabase project settings.
  2. Remove it from client code. Use the anon key in the browser and keep service_role in server-only environment variables.
  3. Check your data. Review tables and logs for changes you didn't make.
  4. Confirm RLS on every table. Add per-user policies to each table.
  5. Scan again. Run the free scan after you redeploy.
faq.txt

FAQ

Is it bad that my anon key is public?
No, that's by design. We note it in your report so you know Row Level Security is what protects your data.
Do I need to sign up?
No. Paste your link, confirm it's your app (or you have permission), and run it. Adding your email is optional and shows the risk breakdown and one problem by name.
What does it cost?
The scan and your score are free. The full list of findings with a fix for each is a one-time $9, or $29 for a pack of 10 reports.
Does it attack my site?
No. It only makes ordinary read requests, sends no exploit payloads, and never logs in or submits forms.
What doesn't it check?
Pages behind a login, third-party scripts, your server code and your database policies directly. A good score is not a guarantee of security.

Run the free scan