Free Supabase security probe
Paste any public app or project URL. VibeGuard reads your deployed bundle for the Supabase URL and anon key, asks PostgREST which tables it exposes, and tries to read one row from each — using exactly the access an attacker already has.
Typically finishes in under ten seconds. Capped at 50 tables and 25 seconds.
No signup
A URL is the only required input. Nothing you paste is stored.
Read-only, provably
Only GET, HEAD and OPTIONS are ever issued. There is no code path that can write.
Your data stays yours
Leaked rows are reported by column name and count, never by value. A found key is stored as a fingerprint.
What the free probe checks
Two of the 9 rules run without any credential. They are the ones that can be demonstrated from outside.
And what it cannot
The probe sees what an anonymous visitor sees. It cannot read your policies, so it cannot tell you whether your writes are constrained, whether a predicate is indexed, or whether a policy is a constant true. Those 7 checks need a connected project.
A clean probe result is genuinely good news about the most common failure. It is not a clean bill of health, and saying otherwise would be the easiest lie in this product.
See all 9 rules