You ship fast with AI.
We make sure it's not a security nightmare.
Share URL, get a report with fixes in 40 seconds.
What you might find
Supabase RLS disabled. Anyone with your anon key can read user data from 4 tables.
Review data from the tables, should everyone see it?
Copy fix prompt for LLM.
No rate limit. Anyone can burn through your OpenAI credits in minutes.
Add rate limiting tied to IP address to your chat.
No auth on Resend endpoint. Bots can send thousands of emails on your account.
Add rate limiting and auth before calling Resend.
Add CAPTCHA on public forms.
Example findings from a real scan. 3 free scans per day.
What you might find
Supabase RLS disabled. Anyone with your anon key can read user data from 4 tables.
Review data from the tables, should everyone see it?
Copy fix prompt for LLM.
No rate limit. Anyone can burn through your OpenAI credits in minutes.
Add rate limiting tied to IP address to your chat.
No auth on Resend endpoint. Bots can send thousands of emails on your account.
Add rate limiting and auth before calling Resend.
Add CAPTCHA on public forms.
Example findings from a real scan. 3 free scans per day.
vs. generic scanners
Database Security
Every scan automatically detects Supabase and probes your database security.
Row Level Security
Tests every table for anonymous read access via count-only queries.
Hidden Table Discovery
Exploits PostgREST error hints to find unlisted tables.
Storage Buckets
Enumerates all buckets and checks file listing permissions.
RPC Functions
Tests each database function for anonymous invocability.
Runs automatically on every scan. No row data is read, only access checks are performed.