Is your Supabase app exposing more than it should?
Your Supabase anon key is meant to be public; Row Level Security is what protects your data. This free check looks for keys that bypass RLS in your public code and gives you a one-minute self-test for your tables. It doesn't query your database.
Uses 1 of your 3 free scans today; a site scanned in the last 24 hours answers from that scan. Passive and read-only: we only look at what any browser can see. Only check sites you own or may test.
What this checks
From the page and scripts every free scan already loads, we look for Supabase keys that bypass Row Level Security (the service_role key and sb_secret_ keys) and Supabase personal access tokens (sbp_). We also tell you, as info, whether your app uses Supabase and whether its anon key is in your code. We never show key values, and we never query your database from this page.
Self-test your tables (one minute)
Run this yourself, against your own project, with the anon key your app already ships. It reads at most one row.
curl -s "https://YOUR_PROJECT.supabase.co/rest/v1/YOUR_TABLE?select=*&limit=1" \ -H "apikey: YOUR_ANON_KEY"
[] or a permission error means a stranger can't read rows from that table (if the table has rows when you're logged in, [] means RLS is filtering them). Any row coming back means anyone can read it: turn on RLS and add owner-only policies (how to enable Supabase RLS). Repeat for each table.
Have ShipLatch test every table
Once you verify you own the app (a meta tag, a file or a DNS record), the Fix Pack runs a read-only check of each table it finds in your code. It requests zero rows and reads only row counts. We only ever test databases whose owner has verified.
Related: The Supabase anon key, explained · Exposed service_role key
Questions
Is my Supabase anon key supposed to be secret?
No. The anon key is meant to be in your frontend. Row Level Security on every table is what protects your data. The keys that must never be public are the service_role and sb_secret_ keys.
Can this tool tell if my tables are readable?
Not on its own. Testing a table means querying your database, and we only do that for apps whose owner has verified ownership (Fix Pack). This page gives you a self-test you can run on your own project in a minute.
Which Supabase keys must never be public?
The service_role key and sb_secret_ keys, which bypass Row Level Security, and personal access tokens (sbp_), which can manage your Supabase account. Keep them on the server only.
Does this use one of my free scans?
Yes. It runs the normal free scan, which allows 3 scans a day. A site scanned in the last 24 hours answers from that scan without using another one.
Check everything, not just this
The full free scan also looks for leaked API keys, exposed .git folders, source maps and missing security headers. Same 3 free scans a day.