Supabase Data-Leak Check · $99 · 2–3 business days · Coming soon
Find out whether your app's database is open to anyone with your anon key.
For apps you own built on Supabase with Lovable, Bolt, v0 or Cursor. I check, passively and with your written permission, whether a service_role key or other secrets are in your front-end, and whether tables and storage buckets can be read or written without the right access. You get a severity-ranked report with exact fixes.
Supabase Data-Leak Check is a fixed-price service from ChikuOS, run by Siddharth Mishra, an independent developer in India. Is your Supabase data readable by strangers? A passive check of your own app for exposed keys and missing RLS. It is planned at $99 with a turnaround of 2–3 business days, but it isn't available to buy yet.
Coming soon Follow @SidShipsAI
What you get
- Exposed secrets scan of your public JavaScript bundles and source maps (service_role key, third-party API keys)
- Row Level Security review of every table, using the policies you export or read-only dashboard access
- Anon-key access test against your own project: what an unauthenticated visitor can read or write
- Storage bucket and RPC/function exposure check
- Severity-ranked findings with the exact SQL policies or code changes to fix them, as a PDF within 2–3 business days
Owner-authorized apps only: at checkout you confirm you own the app or are authorized to have it tested. Passive and non-destructive: no attacks, no load testing, no attempts on other people's systems, and no data beyond the minimum needed to prove a finding is ever kept.
Timeline
- Confirm ownership and share policies or read-only access
- Bundle scan, RLS review and anon-key access test
- Severity-ranked PDF within 2–3 business days
Who it's for
- Owners of Supabase apps built with Lovable, Bolt, v0 or Cursor
- Founders unsure whether Row Level Security is on for every table
- Only apps you own or are authorized to have tested
FAQ
Is this an attack or pentest?
No. Checks are passive and non-destructive, with no load testing and nothing aimed at other people's systems.
Can I order a check on someone else's app?
No. Owner-authorized apps only; you confirm this at checkout.
Do you keep my data?
Only the minimum needed to prove a finding.