Hi community, I recently developed a tool after noticing that AI app builders—such as Adalo, FlutterFlow, Base44, and Retool—configure Supabase backends but leave Row-Level Security (RLS) disabled and exposed by default. This isn't just hypothetical; the CVE-2025-48757 vulnerability has documented over 170 active apps built with Lovable that exhibit this issue (with a CVSS score of 9.3). Independent reviews continue to detect this behavior on a large scale: Symbiotic Security analyzed 1,072 AI-generated apps and found that 98% had at least one issue, while Escape.tech evaluated 5,600 apps, discovering over 2,000 real risks and more than 400 instances of exposed confidential data.
How does my model work? You simply paste your Supabase project URL and your Anon key. Since this data already exists in your app's code running in the browser—making it visible and easily accessible—the model checks whether tables and storage buckets respond without requiring authentication. No registration is required, and the data itself is never touched; the tool merely evaluates whether a table responds and assesses the apparent sensitivity of that response.
I tested it on one of my own projects first, intentionally leaving a test table without RLS and populated with dummy data. Before using the model on external cases, I needed to ensure it was reliable and production-ready.
You can run the scan for free. To get a detailed, downloadable report, you can make a one-time payment of $49; this provides full information on every finding in plain language, along with an SQL solution to fix the issue.
I built the infrastructure using FastAPI, Supabase, and Render. I am happy to explain the detection method and its limitations, and I welcome constructive criticism and feedback. Thanks.
1 comment
[ 5.0 ms ] story [ 30.0 ms ] threadHow does my model work? You simply paste your Supabase project URL and your Anon key. Since this data already exists in your app's code running in the browser—making it visible and easily accessible—the model checks whether tables and storage buckets respond without requiring authentication. No registration is required, and the data itself is never touched; the tool merely evaluates whether a table responds and assesses the apparent sensitivity of that response.
I tested it on one of my own projects first, intentionally leaving a test table without RLS and populated with dummy data. Before using the model on external cases, I needed to ensure it was reliable and production-ready.
You can run the scan for free. To get a detailed, downloadable report, you can make a one-time payment of $49; this provides full information on every finding in plain language, along with an SQL solution to fix the issue.
I built the infrastructure using FastAPI, Supabase, and Render. I am happy to explain the detection method and its limitations, and I welcome constructive criticism and feedback. Thanks.