Do I need to sign up?

No. The public check needs a URL and nothing else.

Will this modify anything?

It cannot. Only GET, HEAD and OPTIONS are ever issued, enforced in code rather than by policy.

What about Bolt, Cursor, v0 and Claude Code?

Identical. The check reads a deployed site and a Supabase project; it does not care what generated them.

Check whether your Lovable app is leaking data

Lovable builds a working Supabase backend in an afternoon. What it does not do reliably is write the policies, and a table without policies is a table the internet can read.

Paste your app URL. VibeGuard reads your deployed bundle for the Supabase URL and anon key, asks PostgREST which tables it exposes, and tries to read one row from each — using exactly the access an attacker already has.

Rules that check this

criticalTable readable with the anon keyANON_TABLE_READABLE
criticalRow Level Security disabledRLS_DISABLED
criticalservice_role key shipped to the browserSERVICE_ROLE_KEY_EXPOSED

What the check proves

If rows come back, that is not a warning, it is a demonstration. The report names the table, the columns exposed, and the number of rows the anon role can see.

Row values are never retained. Column names and a count prove the exposure and carry none of the data.

What a clean result does and does not mean

An empty result is honest about its own ambiguity. PostgREST answers `200 []` both for "RLS filtered everything out" and for "the table is empty", so an empty table is reported as reachable, not as leaking.

A clean probe also says nothing about your write policies — nobody is going to insert rows into your database to prove a point. Connecting the project runs the full catalog audit, which covers writes.

Then stop it happening again

The failure mode with AI builders is not the first mistake, it is the fourth. Every prompt that touches the schema can drop a policy or add a table without one.

Continuous monitoring diffs each scan against the last and alerts on the transition — something appearing, or coming back after being fixed — rather than re-sending the same list every hour.

Frequently asked

Do I need to sign up?: No. The public check needs a URL and nothing else.
Will this modify anything?: It cannot. Only GET, HEAD and OPTIONS are ever issued, enforced in code rather than by policy.
What about Bolt, Cursor, v0 and Claude Code?: Identical. The check reads a deployed site and a Supabase project; it does not care what generated them.

Check your project in about ten seconds

Paste a URL. No signup, no writes, nothing stored.

Run the free audit