Paste your GitHub repo. In under a minute we check for leaked keys, database tables anyone can read, and admin functions strangers can call, then explain each problem in plain English with the exact fix.
Public repos only for now · No signup · Takes 10–60 seconds
We make a temporary copy of your public GitHub repo and delete it after the scan.
Source code, git history, Supabase migrations, storage buckets, edge functions and auth logic.
A 0–100 launch-safety score, with your top issues explained for founders and fixes your AI builder can apply.
Supabase service_role keys (we decode the JWT to tell them apart from the safe anon key), Stripe, OpenAI, Anthropic, AWS, Resend and more, including keys you "deleted" that are still in git history.
Tables with RLS off, USING (true) write policies, "any logged-in user can edit anyone's row", and policies that trust user-editable metadata.
SECURITY DEFINER functions that skip RLS, have no auth check, and can be called by anonymous visitors.
Public buckets holding invoices or uploads, and storage policies that let anyone upload or delete files.
Secrets in VITE_/NEXT_PUBLIC_ vars, auth.admin calls in the frontend, AI SDKs with dangerouslyAllowBrowser.
Admin pages protected only by hiding a button, hardcoded admin emails, roles in localStorage, edge functions that never check the caller.
Other scanners hand you a list. We hand you a working fix.