Is your app leaking keys or customer data?
The deep scan reads your app's own JavaScript and asks your Supabase project what a stranger could see. It finds exposed secret keys, tables anyone can read, login emails that point to a preview build and storage buckets anyone can list. Every fix comes as a prompt to paste into Lovable, Bolt or Replit Agent.
What we found
Unlock the fix prompts
Get a copy-paste prompt for each issue, ready for Lovable, Bolt or Replit Agent, plus your results by email.
Want me to fix it? Deploy Fix $49, done in 48h or refunded
What we checked
What the deep scan checks
- Secret keys in your JavaScript: Stripe live secret keys, OpenAI and Anthropic keys, AWS keys, GitHub tokens, Supabase service_role and secret keys. We show only the last 4 characters.
- Supabase tables readable by anyone: we use only the public key your app already ships, and ask each table once for a single row. We report the table name, never its data.
- Login emails pointing to a preview: password resets and magic links that redirect to a preview build or localhost.
- Storage buckets anyone can list: Supabase Storage buckets that let a stranger list your files. We never read file names or contents.
What is not a problem
Your Supabase anon or publishable key, your Firebase web config and your Stripe publishable key are meant to be public. The scan never flags them on their own.
Is it safe to run?
Yes. The scan is read-only: it never signs in, never creates an account, never writes or deletes anything. It reads only your app's own files (same domain) and your own Supabase project. No table rows, file names or full keys are kept, logged or sent back. Private and internal addresses are refused, and each scan is capped in time and number of requests.
Only scan apps you own or are allowed to test. For a quick surface check of headers, CORS and SEO, use the free app scanner.