Security for apps built on Supabase
Supabase lets you build fast, and that speed is also how security steps get skipped. The free Surface Check detects your Supabase project and tests, read-only, whether your tables are readable without a login, then points you to the deeper risks (writes, storage, app logic) a full review reaches.
Fast to build, easy to expose
Supabase hands you a database, authentication and APIs in minutes. The trade-off is that the safe configuration is yours to get right. The gaps we see most often in Supabase apps are a database table left publicly readable, an API key doing more in the browser than it should, and the ordinary web hardening, HTTPS, security headers, email anti-spoofing, that simply never got set up.
The outside view can’t see this
What the outside view still can't reach: writes, storage and app logic
The free Surface Check now detects your Supabase project from your front-end and tests read access for you, whether tables are readable without a login (a missing Row Level Security policy). What it still can't see is who can write or change that data, whether your storage buckets are locked down, and the access-control logic inside your own app, the kind of flaw where an id you change in a URL returns another customer's record. Those need the project and the code looked at directly, which a full review does.
What the free Surface Check covers for your Supabase app
- Database access: we detect your Supabase project from your front-end and test, read-only, whether any tables are readable without a login, the classic missing Row Level Security policy.
- HTTPS and HSTS on your custom domain, so traffic can't be silently downgraded to plain HTTP.
- Security headers (Content-Security-Policy, clickjacking protection, nosniff) on your front-end.
- Your TLS certificate's health and how soon it expires.
- Cookie flags (HttpOnly, Secure, SameSite) on any session or auth cookies you set.
- Email spoofing: SPF, DKIM and DMARC on your domain, so attackers can't send email as you.
- Exposed secrets: common API keys or tokens (such as a Supabase service_role or Stripe secret key) left in the front-end code your site serves to browsers.
See your external surface in about a minute
A free, passive snapshot with an A-to-F Surface Score and every issue scored by severity and fix effort. No sign-up, and nothing is stored.
Run the free Surface Check →Frequently asked
Does the Surface Check log into my Supabase project?
No, it never logs in and never uses a secret key. It uses only the public anon key your app already ships to every visitor, and only to test, read-only, whether your tables are readable without a login. It never reads your actual data (only whether a table responds, and its row count) and never writes or changes anything. The rest of the check is passive: response headers, TLS, cookie flags and public DNS records.
Will it tell me if my tables are publicly readable?
Yes. It detects your Supabase project from your front-end and tests, read-only, whether any tables are readable without a login, the classic missing Row Level Security policy. What it can't see from the outside is who can write to those tables or the access-control logic in your own code, which a full Secvura review covers.
We built the app with an AI tool on top of Supabase. Does that change anything?
It raises the odds. AI-generated apps ship quickly and often leave RLS off or an over-powered key in the browser, precisely because the security step is the easy one to skip. It is worth checking both your external surface and your database access.
Is the check really free?
Yes, free and with no sign-up. You get an A-to-F Surface Score and every issue scored by severity and fix effort, the same way we score a full report.
More free checks