Skip to content

Free tool

Can anyone read your Supabase database?

Supabase publishes an "anon" key in your app on purpose: it identifies the request but authorises nothing on its own. Row-level security is what authorises. With RLS off, which is the state a tutorial leaves you in, that public key reads every row. We read the key out of your own bundle and issue read-only GETs against common table names. Nothing is written, changed or deleted.

Free, no account, and read-only

What it actually does

Three steps, and none of them touch anything on the address you give it. Worth reading before you point a scanner at your own production site.

  1. Step 1

    Read your own bundle

    The anon key is taken out of the JavaScript your app already publishes. We never ask you for a credential.

  2. Step 2

    Issue read-only GETs

    Common table names are requested with that key. Nothing is written, changed or deleted, and no other method is used.

  3. Step 3

    Report what answered

    A table that returns rows to an anonymous key is a table with no row-level security in front of it.

Read-only. Nothing is signed in to, submitted or changed on the address you enter. See the methodology for how each result is graded.

The rest of it

This is one check of 48.

Row-level security is one finding. The full scan also reads your bundles for leaked keys and checks Firebase and Convex rules the same way.

Run the full free audit

Other free checks

Exposed API keys Run it Source maps Run it Security headers Run it Email deliverability Run it AI robots.txt & AEO Run it

Run your first audit today

Start on the free plan, with enough searches to cover a city and enough audits to judge a shortlist. No card, and it does not expire.

Start free Read the docs