"RLS on" isn't "RLS right"
Supabase lets your browser talk straight to the database. Row level security policies are the only thing deciding who sees which rows. A policy of USING (true) counts as "enabled" but lets everyone read everything.
Pit stops for vibe-coded apps
You shipped fast.
Now lock it down.
Our scanner checks Lovable apps on Supabase for open database tables and leaked secret keys, then generates the exact SQL to lock them down. You paste it into Supabase yourself.
No account, no card and no access to your code or database. Ever.
The problem
Why vibe-coded apps leak data
AI builders get you to a working app in an afternoon. The database rules that keep one user out of another user's data are easy to miss, and a passing checkmark doesn't always mean they're right.
Secret keys in the frontend
Anything in your client code, including VITE_ environment variables, ships to every visitor's browser. Put an OpenAI, Stripe or Supabase service_role key there and anyone can copy it from view-source.
The app keeps changing
Every prompt can add a table or rewrite a file. In Lovable's own words, it "treats code you wrote the same as code it generated, and it can change either in a later request." A fix today can quietly come undone next week.
The receipts
-
CVE-2025-48757: a security researcher reported that apps built on Lovable "often lack secure RLS configurations", and that the security scanner Lovable later added "merely checks for the existence of any RLS policy, not its correctness."
Read the researcher's statement -
Escape.tech reported "2,038 highly critical vulnerabilities and 400+ leaked secrets discovered across 1.4K vibe-coded applications."
Read the Escape report -
A public scan shared on Hacker News reported 2,217 of 20,052 scanned URLs (11.04%) exposing Supabase credentials. In the same thread, Supabase's CEO wrote: "People disabling RLS, or making RLS a simple pass-through, is a battle we are constantly fighting."
Read the Hacker News thread
How it works
In and out of the pits in 3 steps
-
Pit in: free scan
Enter your app's URL. The scanner looks only at what any browser loads (your HTML, JavaScript and response headers) and flags exposed keys and missing headers.
-
Verify you own it
The deeper open-table check only runs after you prove ownership with a DNS TXT record, a verification file or a meta tag. It's read-only, uses the public anon key your app already ships, and reports table names and counts, never your data.
-
Tyre change: you apply the kit
Download your Lockdown Kit instantly: SQL policies for every exposed table, bucket privacy fixes, a test file, a rollback script and a step-by-step guide. You run it in your Supabase SQL Editor. Add Pit Watch and the scanner re-checks your app on a schedule.
Free check
Pit in: request your free check
Tell us where your app lives. The scanner runs the passive check (only what any browser loads) and your results arrive by email.
Prefer email? Write to [email protected] with your app's URL and what you built it with.
Pricing
Simple pricing, no surprises
For Lovable apps on Supabase, including Lovable Cloud. Prices in USD.
Free Check
$0
- Automated scan of your live URL, no access needed
- Secret keys exposed in your JavaScript
- Supabase detection and security headers
- Open-table check once you verify ownership (names and counts only)
Instant download
Lockdown Kit
$39 one-time
- Personalized report generated from your scan
- Ready-to-run SQL with RLS policies (
USINGandWITH CHECK) for every exposed table - Storage bucket privacy fixes
- Key rotation checklist and a guide to moving secrets server-side
- pgTAP test file: user A can't read, change or delete user B's rows
- Rollback script and step-by-step Supabase guide
- You apply it yourself. No access to your code or database
Pit Watch
$19 / month
- Automated scheduled scans of your live app
- Emailed report after every scan
- Alert when a new table, bucket or key becomes exposed
- Updated Lockdown Kit SQL when new issues appear
- Cancel anytime
Checkout is coming soon. Start with the free check today.
Disclaimer: Lockdown Kits are generated automatically by software from your scan results and provided "as is". They're not a penetration test, security audit or guarantee that your app is secure. You're responsible for reviewing and applying the SQL: back up your database and run the included tests on a Supabase branch or staging project first. See our Terms.
FAQ
Questions from the grid
Can I scan any app?
No. The free passive scan only reads what any browser already loads. Anything deeper (the read-only open-table check, Lockdown Kit and Pit Watch) requires you to verify ownership first, by adding a DNS TXT record on your domain, a small verification file on your site, or a meta tag. Without it, the scanner never sends a request to your database.
What does the free check look at?
Without verification, only what any visitor's browser already loads: your HTML, JavaScript files and response headers. The scanner looks for secret key types (full keys are never shown), whether Supabase is in use, and missing security headers. After you verify ownership, it also runs read-only requests with your public anon key to see which tables and buckets are open. Reports show table names and row counts, never row data, and nothing is written to your live app.
Do you need access to my code or database?
No. The scanner reads only what your app already sends to browsers. You verify ownership with a DNS record, a file or a meta tag, and you apply the SQL yourself. We never ask for your repo, your Supabase login or your service_role key.
I'm on Lovable Cloud. Does this work?
Yes. The kit includes the exact SQL and a ready-to-paste Lovable prompt, so you can apply each fix yourself.
Could the SQL break my app?
Strict rules can lock out real users if they're wrong. Every kit includes a pgTAP test file with a check that a normal signed-in user can still see their own data, plus a rollback script. Back up first and run the tests on a Supabase branch or staging project before touching production.
Is this a penetration test or a security certification?
No. It's automated software that checks for and generates fixes for the most common problems in Lovable + Supabase apps: row level security, exposed keys, storage buckets and secrets in git history. It's not a full audit and can't promise your app is free of every vulnerability. Your report lists what was checked and what wasn't.
How is the kit made?
The scan and kit are generated by software from tested templates. Nobody looks at your code, because we never receive it.
I think a key already leaked. What now?
Rotate it first, at the provider (OpenAI, Stripe, Supabase and so on), since removing it from your code doesn't make a copied key stop working. The Lockdown Kit includes a rotation checklist with direct links and a guide to moving the key into a Supabase Edge Function secret. We never ask you to send us the key itself.
Why would I need Pit Watch?
Every new prompt can add a table or move code around, and a new table without row level security can be readable by anyone holding your public anon key. Pit Watch scans your live app again on a schedule and emails you when something new is exposed, before someone else finds it.
Do you support Bolt, v0, Replit, Cursor or Firebase?
Not yet. We're starting with Lovable apps on Supabase because that's where these problems come up most. Email us if you're on something else and we'll let you know when support arrives.
Box, box, box.
Find out what your app is showing the world before someone else does.
Get a free check