CheckVibeCodeCheckVibeCode
Checks/Configuration
ConfigurationLive — auto-discovered8 checks

Supabase Security Scanner

Audit your Supabase project for RLS misconfigurations, exposed APIs, and insecure auth settings.

Run this scanSee pricing

How this scan works

  • Auto-detects the project's Supabase URL and anon key from the homepage and its JS bundles (or takes them directly when you connect the project)
  • Calls the public /auth/v1/settings endpoint (no key required) — reports enabled providers, whether signups are open, email-confirm requirement
  • Reads PostgREST's schema document at /rest/v1/ with the anon key — enumerates every table/view AND every stored procedure the anon role can reach, and flags the schema disclosure itself
  • GETs each of those real tables (falling back to common names if the schema is locked down) with only the public anon key — a 200 with rows indicates missing or loose Row Level Security
  • Lists Storage buckets and probes /storage/v1/object/list on each with the anon key — flags any bucket whose objects are enumerable without auth
  • Checks for the anon key mistakenly carrying elevated (service_role) privileges by decoding its JWT role claim

More checks in Configuration

Security Headers ScannerSSL/TLS Security ScannerCookie & Session Security ScannerMobile Interface ScannerContainer & IaC Misconfiguration ScannerFirebase Security Scanner