TrustBoost / vibe-code security
Find what your app left unlocked, before someone else does.
Apps built with Lovable, Bolt or Base44 ship in minutes — but most leave at least one Supabase table readable by anyone. Paste your URL and know in under a minute.
No signup Read-only Your code stays untouched No SQL or dashboard needed
Check your Supabase project
The scan itself is 100% free, always. If it finds something, a $49 report explaining the exact fix is offered afterward — entirely optional, never required to see your scan result.
Project Settings → API → "anon public" in your Supabase dashboard. Never paste your service_role key.
Adds one extra check: whether your service_role key (the master key that bypasses all security rules) is accidentally exposed in your app's own code.
1
Looking for exposed tables
2
Testing anonymous read access on each
3
Scoring the severity of what we found
0tables checked
0with findings
Detailed report
Every finding explained in plain language, with severity and exact fix.
$49
Automatically connects to your wallet extension. USDC on Base network only — sending on any other network results in permanent loss of funds.
This is exactly how we reproduce the mistake that exposes your data.
01
We look for your tables
We try the table names most common in real apps — the same starting point anyone with your public URL would have.
02
We request a sample
Using the same public key already sitting in your browser's code — nothing a normal visitor couldn't also do.
03
We score how serious it is
If something responds, it goes through our sensitive-data classifier to tell you whether it's noise or a real problem.
Why this matters right now
2026 security research found hundreds of apps built with these tools exposing full user records because of a single security policy left off. The pattern keeps repeating because AI tools generate the connection to the database, but don't always turn on the permission layer.
- We don't store your anon key after the scan finishes
- We never write, modify, or delete anything in your project
- We only check what's already publicly reachable from a browser
- The same classifier used here runs in production inside TrustBoost
Common questions, answered plainly.
Doesn't Supabase already have a free tool for this?
Yes — Supabase's own Security Advisor (Database → Security Advisor in your project dashboard) checks for similar things, for free. The difference: it lives inside a technical dashboard and assumes you can read SQL and policy rules. This scan is built for everyone else — you paste two values you already have, get a plain-language answer, and if something's wrong, a ready-to-paste SQL fix. No dashboard, no SQL knowledge required.
Does this touch my code or my users' data?
No. The scan only reads what's already publicly reachable from any visitor's browser, never writes or modifies anything, and doesn't store the data values it finds — only whether a table responded and how sensitive the response looked.
Acceptable Use Rules
Last updated 2026
This scanner performs read-only checks against publicly reachable Supabase endpoints, using the anonymous key already exposed in your app's client-side code.
You must confirm authorization
You may only scan a project you own, or one you have explicit permission to test. Scanning a third party's project without authorization is not permitted, and access attempts are logged.
What the scanner will never do
- Attempt to bypass authentication or exploit a vulnerability beyond confirming that data is exposed
- Write, modify, or delete any data
- Retrieve more than a small read-only sample from each table
Fix requests
If you purchase a fix, we will never ask for your service_role key as a first step. You'll receive the exact SQL to run yourself in your own Supabase SQL editor, with guidance, and we re-verify the result using the same read-only scan. Hands-on access, if ever needed, is granted temporarily and only with your explicit approval.
No guarantee
Results are best-effort and based on common table names and default configurations. A clean scan does not guarantee your application has no security issues — it is not a substitute for a full professional security audit.
Privacy Policy
Last updated 2026
What we collect
- The project URL and anon key you submit — used only to run the scan, and never written to our database
- A hashed version of your IP address, kept temporarily to enforce fair-use rate limits
- If you purchase a report or fix: the contact email you provide
Payments
Paid reports and fixes are processed by a third-party payment provider. We do not receive or store your card details.
Aggregate statistics
We may keep anonymized, aggregate figures (for example, "X% of scanned tables lacked a security policy") for research and public write-ups. These never identify your project or organization.
Your rights
You can request deletion of any contact information we hold about you at any time by reaching out through the contact details provided at checkout.
Terms of Service
Last updated 2026
The service
TrustBoost provides an automated, best-effort security scan for Supabase-backed applications, plus optional paid detailed reports and remediation.
No warranty
The scan and any report are provided "as is," without warranty of completeness or accuracy. They do not constitute a professional security audit or legal compliance certification.
Limitation of liability
To the maximum extent permitted by law, TrustBoost is not liable for indirect, incidental, or consequential damages arising from use of this tool or reliance on its results.
Payment and refunds
Paid reports and fixes are one-time purchases. Refund terms are shown at checkout before payment.
Governing law
These terms are governed by the laws of Colombia, without regard to conflict-of-law principles.