Madsalt Supabase Checker

You built an app over a weekend with an AI coding tool. Sign-up works, the dashboard loads, and a friend has already made an account. What you can't see from the browser is whether a stranger holding your public key could read every row in a table, because row-level security was never switched on.

That's the worry this free scanner is built for. Its page is aimed at teams shipping with Lovable, Bolt, Cursor or v0 on Supabase. You connect one project read-only, and it checks that project against 46 rules mapped to the OWASP Top 10:2025.

Connecting means approving read-only access through Supabase's own login. You then pick a project, confirm you're human and start the scan. The checks cover access and row-level security, sign-in settings, storage, Edge Functions and infrastructure.

To do that, the scanner reads the database catalog, which holds things like tables, policies and grants. It also reads auth settings such as password rules and MFA, the list of storage buckets, and project settings such as backups and SSL. The page is just as specific about what it never reads. Rows in your tables, files in your buckets and your app code are all off limits, and any API key that turns up in a settings reply is dropped without being stored. The access grant is revoked right after the check.

The result is a graded report with a fix for each finding, given as SQL or a dashboard setting. There's also a prompt you can paste into Cursor, Claude Code or Lovable, which is a nice touch for people who built the app that way in the first place.

The check is free and needs no sign-up beyond the Supabase login. A report is stored only if you create a share link, and then for seven days at most. According to the privacy page, last updated November 5, 2026, the access token sits in a sealed cookie that expires 15 minutes after you connect.

The page is frank about its blind spots. Two of the ten OWASP categories are marked as not checkable, because insecure design and error handling live in app code. It also can't tell whether one signed-in user can read another user's rows, which needs a test with two real accounts. A clean report doesn't mean a safe app.

The site is run by Denys Zaichenko in Porto, Portugal, and it doubles as his shop window. The same menu and footer link to his paid services, including an app audit listed at €490. The checker is useful by itself, and it also introduces someone who'd fix the findings for a fee.

If you shipped on Supabase in a hurry, a scan is a sensible way to find out what you left open.