AppLeakWatch
Supabase RLS checker
Your Supabase public key is meant to be public, so row-level security is what actually protects your data. AppLeakWatch uses the same key your site already publishes to test whether tables answer without a login.
What usually goes wrong
Tables with RLS off or too open
We try to read a single row from each table we can see. We only confirm access is open, and we don't keep the data.
Public storage buckets
We flag public buckets so you can confirm nothing private is in them.
Signups without email confirmation
Without it, people can create accounts with addresses they don't own.
What else we check
- API keys for Stripe, OpenAI, Anthropic, AWS and others in your public code
- Downloadable .env, .git and database backup files
- API addresses that return data without a login
- SPF and DMARC records that stop people faking your email
- HTTPS redirects, certificates and browser security headers
How it works
Add your domain, prove you own it with one small change, and get a report with a letter grade and every check we ran. Scans only read public addresses and never change anything. No scan can prove an app is secure, but it can find the mistakes strangers look for first.
More scanners
- Security scanner for Lovable apps
- Security scanner for Bolt apps
- Security scanner for apps built with Cursor
- Security scanner for Replit apps
- Security scanner for apps built with v0
- Security scanner for apps built with Windsurf
- Security scanner for Base44 apps
- Firebase security rules checker
- Exposed API key scanner