FREE SUPABASE SECURITY CHECK · 30 SECONDS

Is your database open to the internet?

Apps built with Lovable, Bolt, Cursor and v0 often ship with Row Level Security off, which means anyone can download your users table. Paste two things from your Supabase dashboard and find out whether yours is one of them.

Supabase → Project Settings → API. It looks like https://abcd1234.supabase.co

Same page, labelled anon public (or a sb_publishable_ key). It’s already inside your app’s JavaScript, where anyone can find it. That’s by design, and it’s why RLS matters. Never paste the service_role key, here or anywhere.

Free. No signup. Reads counts, never rows. Nothing is stored.