Is my database readable by anyone?
Many apps built with AI tools store their data in Supabase and ship a public key to every visitor. If a table has no rule about who may read it, anyone with the address can read the whole thing. This check finds your app’s public key the way a visitor’s browser would, then tries to read each table, and shows you exactly what came back, with every value blanked past its first two characters.
Free. No sign-up. We only look at what any visitor can already see.
What this check can and cannot see
If we can reach your database from outside, this finds it. If your app keeps its data somewhere we cannot see from the outside, this check will say so rather than pretend it is clear. It reads only; it never changes or keeps your data.
What we will never doChange anything in your app, or keep your customers’ data. A finding holds a count, the column names, and one sample blanked past its first two characters.