FREE TOOL · SUPABASE SCAN

Free Supabase exposure scan

Check what anyone can read from your Supabase project with the public key that ships in your website. It runs in your browser, is read-only, and stores nothing.

Project URL

Supabase dashboard → Project Settings → API.

Anon (publishable) key

Use the public anon or publishable key only. Never paste a service_role or secret key; if you do, we stop and send nothing.

Table names to test (optional)

Only needed if your project hides its table list from the anon key.

I own this Supabase project or I'm authorized by its owner to test it. I understand this check runs in my browser, sends my anon key only to my own project, makes read-only requests (no writes, no data downloaded beyond row counts), and that VibePitstop never receives or stores the key or the results.

Fixed, or we keep working free until it is (within the written scope).
A human reviews every fix before it ships.
read-only access; fixes arrive as pull requests you merge
Your $149 diagnosis is credited in full toward any paid job.

What it checks

Whether the key you entered is safe to be public (it refuses secret keys before sending anything).
Auth settings: public sign-up, email confirmation, sign-in providers.
Every table the anon key can reach: whether any rows are readable, using a row count only.
Storage buckets the anon key can list, and which are public.

Not tested: writes, updates, deletes, signed-in users, or function behavior. A clean result does not prove your app is secure.

Questions

Is the Supabase scan free?

Yes. It is free, needs no account, and runs in your browser.

Does VibePitstop see my key or my data?

No. Your browser talks directly to your own Supabase project. We never receive or store the key or the results, and the scan reads row counts only, never your data.

Which key should I use?

The public anon or publishable key, the one that already ships in your website. The scan refuses service_role and secret keys before sending anything.

What does a clean result mean?

That the anon key could not read rows from the tables checked. It does not test writes, signed-in users or functions, so it does not prove your app is secure.

Also free: the error checker. Read the guides for Supabase RLS and launch checklists.