For Supabase apps built with Lovable, Bolt, Replit and Cursor
Is your app leaking data?
Paste its address. See what a stranger can read, change or download.
- No account needed
- It takes under a minute
- We only look at what anyone on the internet can already see
- This check changes nothing in your app
Harbordemo-app.example
4 open findings
2 critical2 high
- CriticalYour app hands every visitor a key with Stripe's live prefix.
page-042961aeec436551.js - CriticalYour app hands every visitor a key that bypasses every rule you have set.
page-042961aeec436551.js - HighAnyone can list the files in avatars.
avatars
And 1 more finding, worst firstOpen the example report
What it checks
The Outside check: what anyone on the internet can reach from your app's address.
- Keys in your codeA secret key sent to every visitor's browser
- TablesWhat anyone can read without signing in
- Storage bucketsWhich storage buckets let anyone list their files
- Sign-upWho can make an account
What you get
What a report shows you, and what connecting your database adds.
- The worst firstEvery finding, from Critical to Low.
- Proof for eachWhat we asked, and what your app answered.
- A fix your builder can pasteConnect your database and we draft the fix, then test it again to prove it worked.