Checker
Supabase RLS checker
Paste the deployed URL. If the page contains a Supabase project URL and an anon or publishable key, LeakWatch asks PostgREST for table names and at most one row. It keeps the table name, the column names, and one example row with every value masked. A service_role JWT or an sb_secret key is never used for that request.
The free report names every finding, with its severity and category. The most serious one is shown in full. The others keep the location, evidence, and fix prompt for the $19 Proof Report. One free scan per network every 30 days.
What this page is for
A row comes back
The anon key can read the table. Personal or payment columns make that read critical. Any other returned row is high.
The request is allowed and the table is empty
HTTP 200 with no row still means the key was allowed to ask. That is reported as medium.
The anon key itself
The anon key and the publishable key are public configuration. They become a finding when they can read a table. The longer guide is at the Supabase RLS check.
Questions
- Is this a login test?
- No. The request uses only the key already shipped in the page. LeakWatch does not create a user, submit a form, or write a row.
- Does this use the free scan?
- Yes. It is the same read-only scan, so the other checks run too. One free scan is allowed per network every 30 days.
A Proof Report is $19 once. Monitoring is $9/month. Pro is $29/month. No subscription is required for the report. See pricing.