Free tool · runs in your browser · read-only
Supabase exposure checker
This free tool checks what a signed-out visitor can reach in your Supabase project using the public anon key your app already ships. It lists which tables return rows, whether your API schema and functions are visible, and which storage buckets are public. It's read-only: it counts rows without reading them, never writes, never calls functions, and refuses service_role and secret keys. It runs in your browser and sends nothing to ChikuOS.
Authorised use only. Check projects you own or have permission to test.
What it checks
- Schema listing: whether your REST API lists tables and functions to the anon key.
- Readable tables: a HEAD request with an exact count for each table. It sees the count, never the rows.
- Functions: names only, so you can check their EXECUTE grants. They're never called.
- Storage buckets: which buckets the anon key can list, and whether each is public.
What it doesn't check
Write access, what signed-in users can see of each other's data, your RLS policy logic, function behaviour, or secret keys in your front-end code. Our Supabase Data-Leak Check covers those; free alternatives are in Supabase security checkers compared.
FAQ
Does this tool send my key anywhere?
No. The check runs in your browser and talks only to your own Supabase project. Nothing is sent to ChikuOS, and the key is cleared from the form when the check finishes.
Why won't it accept my service_role or secret key?
Those keys bypass Row Level Security and must never be in a browser. The point of the check is to see what a stranger with your public key can do, so it only accepts the anon or publishable key.
Does it read my users' data?
No. It sends HEAD requests that return a row count but no rows, and it lists storage bucket names, not files. It never writes and never calls your database functions.
What if my schema isn't listed?
On newer Supabase projects the OpenAPI schema often needs the secret key, so the anon key gets HTTP 401. That is normal and does not mean your data is private. Paste your table names into the box and the tool will check those with read-only HEAD requests.
Can I use it on someone else's app?
Only if you're authorised to test it. Use it on projects you own or have written permission to check.