VibeGuard

Free Supabase security probe

Paste any public app or project URL. VibeGuard reads your deployed bundle for the Supabase URL and anon key, asks PostgREST which tables it exposes, and tries to read one row from each — using exactly the access an attacker already has.

Use the URL of your deployed app. VibeGuard reads the public bundle to discover its Supabase connection.

Optional: paste your Supabase anon or publishable key

Anon/publishable keys only. Never paste a service_role key.

Read-only. The scanner never issues a write, and nothing you enter is stored.

Typically finishes in under ten seconds. Capped at 50 tables and 25 seconds.

No signup

A URL is the only required input. Nothing you paste is stored.

Read-only, provably

Only GET, HEAD and OPTIONS are ever issued. There is no code path that can write.

Your data stays yours

Leaked rows are reported by column name and count, never by value. A found key is stored as a fingerprint.

What the free probe checks

Two of the 9 rules run without any credential. They are the ones that can be demonstrated from outside.

And what it cannot

The probe sees what an anonymous visitor sees. It cannot read your policies, so it cannot tell you whether your writes are constrained, whether a predicate is indexed, or whether a policy is a constant true. Those 7 checks need a connected project.

A clean probe result is genuinely good news about the most common failure. It is not a clean bill of health, and saying otherwise would be the easiest lie in this product.

See all 9 rules