# VibeGuard

> Continuous security monitoring, schema-drift detection and automated RLS auditing for Supabase backends.
> Built for backends generated by Cursor, Lovable, Bolt, Claude Code and v0.

## Core product
- Free public probe, no signup, read-only: POST /api/v1/probe/public
- Continuous monitoring: scheduled catalog audits over a Postgres connection, with drift diffing
- Alerts: Slack, Discord, email, generic webhook — fired on transitions, not on every scan
- Pricing: Free (1 project, daily) · Indie $19/mo (3 projects, hourly) · Team $49/mo (15 projects, 15-minute)

## Detection rules that ship today
These are the complete set. Anything not listed here is not detected.

### Catalog rules (require a connected project)
- RLS_DISABLED (critical): Row Level Security disabled → /docs/rules/rls-disabled
- RLS_NO_POLICIES (high): RLS enabled but no policies → /docs/rules/rls-no-policies
- RLS_TAUTOLOGY (critical): Policy always evaluates to true → /docs/rules/permissive-policy
- MISSING_WITH_CHECK (high): Write policy without WITH CHECK → /docs/rules/missing-with-check
- UNINDEXED_RLS_PREDICATE (medium): RLS predicate column is not indexed → /docs/rules/unindexed-rls
- PUBLIC_BUCKET_EXPOSURE (high): Storage bucket is public → /docs/rules/public-bucket-exposure
- RLS_UNWRAPPED_AUTH_CALL (medium): auth.uid() not wrapped in a subquery → /docs/rules/unwrapped-auth-uid

### Probe rules (public, no credential)
- SERVICE_ROLE_KEY_EXPOSED (critical): service_role key shipped to the browser → /docs/rules/service-role-exposure
- ANON_TABLE_READABLE (critical): Table readable with the anon key → /docs/rules/anon-table-readable

## Not detected
VibeGuard does not currently check SECURITY DEFINER views, anon-callable
SECURITY DEFINER functions, or function search_path mutability. The Supabase
Security Advisor covers those; manual queries are documented at
/solutions/security-definer-view-bypass.

## Guides
- Prevent Supabase RLS bypass → /solutions/supabase-rls-bypass-prevention
- Detect a service_role key in your client bundle → /solutions/service-role-key-leak-detection
- Why your Supabase bill spikes after adding RLS → /solutions/unindexed-rls-performance
- Check whether your Lovable app is leaking data → /solutions/lovable-supabase-data-leak
- Bolt.new shipped tables without RLS → /solutions/bolt-supabase-rls-missing
- Audit the Supabase policies Cursor wrote → /solutions/cursor-supabase-security
- Detect Supabase schema drift after migrations → /solutions/schema-drift-detection-supabase
- SECURITY DEFINER views and functions that bypass RLS → /solutions/security-definer-view-bypass
- What the Supabase Security Advisor does not do → /solutions/supabase-security-advisor-limitations
- Continuous RLS monitoring for Supabase → /solutions/continuous-rls-monitoring

## API
- Public probe: POST /api/v1/probe/public
- Connect a project: POST /api/v1/projects/connect
- Force a scan: POST /api/v1/projects/:id/scan-now
- Findings: GET /api/v1/projects/:id/findings
- Live scan status (SSE): GET /api/v1/projects/:id/stream

## Optional
- Full agent context: /llms-full.txt
- Free audit: /audit
- Rules index: /docs/rules