**Free scanner for exposed Supabase data in AI-built apps (Lovable, Bolt, Base44)**

> Free scan for apps built with Lovable, Bolt or Base44 — checks whether your Supabase backend is exposing data with no Row Level Security. TrustBoost / vibe-code security How it works Find what your app left unlocked, before someone else does. Apps built with Lovable, Bolt or Base44 ship in minutes — but most leave at least one Supabase table readable by anyone. Paste your URL and know in under a minute. No signup Read-only Your code stays untouched FREE SCAN Check your Supabase project Project URL Anon key (public) Project Settings → API → "anon public" in your Supabase dashboard. Never paste your service\_role key. I own this project, or I have explicit authorization from its owner to test it. Scan now 1 Looking for exposed tables 2 Testing anonymous read access on each 3 Scoring the severity of what we found RESULT — 0 tables checked 0 with findings Detailed report Every finding explained in plain language, with severity and exact fix. $49 Pay with card Pay with USDC Automatically connects to your wallet extension. USDC on Base network only — sending on any other network results in permanent loss of funds. This is exactly how we reproduce the mistake that exposes your data. 01 We look for your tables We try the table names most common in real apps — the same starting point anyone with your public URL would have. 02 We request a sample Using the same public key already sitting in your browser's code — nothing a normal visitor couldn't also do. 03 We score how serious it is If something responds, it goes through our sensitive-data classifier to tell you whether it's noise or a real problem. Why this matters right now 2026 security research found hundreds of apps built with these tools exposing full user records because of a single security policy left off. The pattern keeps repeating because AI tools generate the connection to the database, but don't always turn on the permission layer. We don't store your anon key after the scan finishes We never write, modify, or delete anything in your project We only check what's already publicly reachable from a browser The same classifier used here runs in production inside TrustBoost TrustBoost — security auditing for AI-built apps Rules Privacy Terms × Acceptable Use Rules Last updated 2026 This scanner performs read-only checks against publicly reachable Supabase endpoints, using the anonymous key already exposed in your app's client-side code. You must confirm authorization You may only scan a project you own, or one you have explicit permission to test. Scanning a third party's project without authorization is not permitted, and access attempts are logged. What the scanner will never do Attempt to bypass authentication or exploit a vulnerability beyond confirming that data is exposed Write, modify, or delete any data Retrieve more than a small read-only sample from each table Fix requests If you purchase a fix, we will never ask for your service\_role key as a first step. You'll receive the exact SQL to run yourself in your own Supabase SQL editor, with guidance, and we re-verify the result using the same read-only scan. Hands-on access, if ever needed, is granted temporarily and only with your explicit approval. No guarantee Results are best-effort and based on common table names and default configurations. A clean scan does not guarantee your application has no security issues — it is not a substitute for a full professional security audit. × Privacy Policy Last updated 2026 What we collect The project URL and anon key you submit — used only to run the scan, and never written to our database A hashed version of your IP address, kept temporarily to enforce fair-use rate limits If you purchase a report or fix: the contact email you provide Payments...

**来源信息**
- **来源**：Hacker News：AI 热帖
- **分类**：ai-products
- **发布时间**：2026-09-20 14:14（北京时间）
- **原文**：[打开原文](https://api.trustboost.dev/free-scan)