IS YOUR SUPABASE DATABASE
PUBLICLY EXPOSED TO ANYONE?
Over 74% of apps generated with AI tools leave Row Level Security (RLS) disabled. Test your production URL now — we verify if your tables or secret keys are leaking.
ANATOMY OF THE FLAW
WHY AI-GENERATED SUPABASE APPS FAIL AUDITS
Missing Row Level Security (RLS)
AI coding tools (Bolt, Cursor, Lovable) generate tables without ALTER TABLE ENABLE ROW LEVEL SECURITY. Anyone can run GET /rest/v1/users with your anon key and dump your entire database.
Leaked service_role Secret Key
When queries fail during prototyping, AI assistants often place the admin service_role key into NEXT_PUBLIC_* or VITE_* environment variables, granting full admin takeover.
Client-Only Route Guards
Protecting private pages with React redirects like if (!user) router.push("/login") while the underlying database tables or API endpoints have zero session authorization.
Permissive Anon Policies
Setting CREATE POLICY "Allow all" ON table FOR ALL TO public, allowing unauthenticated attackers to overwrite, modify, or delete user records.
INSTANT REMEDIATION
COPY-PASTE FIX PROMPTS FOR CURSOR COMPOSER
ScanMyVibe does not just show errors — it generates the exact SQL and code fix prompts ready to paste directly into your IDE.
ALTER TABLE public.users ENABLE ROW LEVEL SECURITY; CREATE POLICY "Users can only read own data" ON public.users FOR SELECT TO authenticated USING (auth.uid() = id); -- Block unauthenticated public access via anon key: REVOKE ALL ON public.users FROM anon;
PROTECT YOUR DATABASE BEFORE YOUR NEXT LAUNCH
Run a scan in 20 seconds. Unlock lifetime access for $39 or run free manual audits anytime.