Find out what a stranger can reach.
€39one payment, no subscription
Instant download. Fourteen days to change your mind, which in the EU is your right and not a favour.
You shipped something real with Lovable, Bolt, Cursor or Claude Code. Now a stranger can probably read every row of your database. This kit finds out, and ships the file that closes it.
One zip, 102 files. No subscription, no account, no server. Fourteen-day refund.
$ node scan/audit.mjs
2 FAIL, 1 WARN → exit 1
THE PROBE EVERY VIBE-CODED APP FAILS FIRST
Every app built on Supabase ships its public key inside the JavaScript. That is by design, and it is fine. It also means Row Level Security is the only lock on your data, and the AI that built your app almost certainly never turned it on.
Copy the public key out of your own page source and send one read to any table:
# read-only, against your own project
curl "https://YOUR-PROJECT.supabase.co/rest/v1/your_table?select=*&limit=1" \
-H "apikey: YOUR_PUBLIC_ANON_KEY"
If a row comes back, every row is public. If you get an empty array, that is not proof either: an empty table passes this test for the wrong reason. Write one row as a real signed-in user and run it again.
That is probe one of nineteen. The kit runs the safe ones for you, prints the exact command for the handful that must be run by hand, and ships the SQL that fixes this one: RLS on for every table, each user sees only their own rows, with a verifier that proves it held.
WHAT IS INSIDE
Every claim in this kit is a probe with an exit code behind it. There is no score and no grade. A check either passed, failed, warned, or could not reach your site, and the kit never reports the last one as a pass.
SECURITY
SEO
EU LEGAL
OPS
HOW IT RUNS
The kit ships the instruction files a coding agent looks for. Your job is to answer its questions, do the few steps that need a person at a browser, and say yes or no when it asks before writing anything.
Outside your repository, or inside a folder you have gitignored. Copy one example config and fill in your domain, your gated paths and your public key.
It detects your framework, runs the four code-side checks, then the live scan, reads the report, and applies the fixes in the order that matters. Secrets first, because a leaked key makes every other fix pointless.
After every fix. A fix that does not move a FAIL to a PASS was not applied. When the table has no open failures, the kit hands you the six checks only a human can do.
SCOPE, STATED PLAINLY
The full list of what this kit does not cover ships inside it, in the README. A kit that pretends to cover everything is how you end up with a false PASS.
QUESTIONS PEOPLE ASK FIRST
The checklists, the scanner and the code-side prompts will. The drop-in fix files assume Next.js App Router, so on a Vite single-page app you get the audit and the guidance but not the files. One of the prompts confirms which stack you have.
No. The scanner runs on your machine, against your own site, and writes a report into your own folder. There is no account, no server and no telemetry. It reads environment variable names, never their values.
No, but you need a coding agent, and you need to be willing to run a few commands and click through your own dashboards. Rotating a leaked key and turning on two-factor authentication are things only you can do.
The scanner is read-only. The four destructive probes are not automated at all: they either write a row or count as login attempts and would lock you out of your own login for fifteen minutes. The kit prints those for you to run by hand, once.
The scan cannot. The fixes can, like any change, which is why each one goes in with its own prompt, in a set order, and the kit tells you to re-run the scan after each one.
One zip, 102 files: four checklists, the scanner, 24 fix folders each with a prompt, six paste-in prompts, and the two agent instruction files. Updates to the kit are included.
€39one payment, no subscription
Instant download. Fourteen days to change your mind, which in the EU is your right and not a favour.