Free tool
Is your Supabase leaking?
Paste the public address of an app you own. We read that page and its scripts, then tell you in plain English what a stranger could already see.
What this check does, and what it does not
- It looks for a Supabase project address and the public key that apps put in the browser.
- It flags a service key or secret key if one is sitting in that public code.
- With only the public key, it asks each listed table for a single row. It counts tables that answer. It does not keep the rows.
- It notes a public source map, and whether the page sends Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options.
- It does not sign in, change data, guess passwords, or store the address beyond a score in the server log.
Next step
Book a free technical assessment.
Thirty minutes. We look at where you are, whether you are about to build, ready to launch, or already live, and tell you what matters first. You leave with a written next step, whether or not you hire us.
Every price is a custom quote after your assessment. No work starts until you accept the proposal.