Security checks for any AI‑built app.

Paste your URL. Preflight checks what a stranger can see: leaked keys, exposed files, weak headers, outdated libraries. On Supabase it goes further: it signs in as two test users and checks whether one can read the other's data.

Before launch · demo app

demo-notes.app

Secret keys in JS bundle None found
Exposed .env, .git, source maps 1 found
Security headers 2 missing
Known-vulnerable libraries Checked
TLS, SPF, DMARC Checked
Supabase: user A reads B Fail · 214 rows RLS is on and a policy exists. It just doesn't hold. Fix ready.

Sample run · demo app · synthetic data

A pilot's gloved hand shines a flashlight along an aircraft wing at dawn during a preflight walk-around.

Pilots walk around the plane before every flight. Do the same before every launch.

16,326

Supabase databases had tables anyone on the internet could read, in a scan of about 300,000 Supabase domains.

UpGuard research, September 2026

What gets checked

Every check runs from the outside, the way a stranger would see your deployed app, and only after you prove you own the domain. Whatever built it: Lovable, Bolt, Cursor, Claude Code, Replit or your own hands.

Supabase apps: the cross-user read test

You create two throwaway accounts. Preflight signs in as A and tries to read B's rows, table by table, plus any read-only database functions open to signed-in users. It records counts and table names, never the rows. This is the deep database test, and it's Supabase-first. Firebase is next if enough of you ask for it.

Leaked secrets in your bundle

Stripe secret keys, OpenAI and other AI provider keys, AWS keys, Supabase service-role keys and similar, shipped to the browser. Always masked in reports.

Security headers

Content-Security-Policy, HSTS, frame options, CORS, and cookie flags (Secure, HttpOnly, SameSite), with the exact lines to add for your host.

Exposed files and routes

Public .env and .git, backup files, source maps, and debug or admin routes left open.

Auth and sign-up settings

Sign-ups without email confirmation, anonymous sign-ins, open sign-up where you didn't mean it, public storage buckets.

Known-vulnerable libraries

Front-end libraries we can identify in your bundle, matched against public CVEs.

TLS and email DNS

Certificate expiry and HTTPS setup, plus SPF and DMARC so nobody can easily send email as your domain.

Open databases (Firebase too)

Supabase tables readable without signing in, and Firestore or Realtime Database rules open to the world. Counted, never downloaded.

Unsigned payment webhooks

Flagged where we can detect them from outside. They're often only visible in code, so the full check comes with the code tier.

What we check that built-in scans don't

facts, not a takedown

Use your platform's built-in checks. They're free and good. Supabase's Security Advisor and Lovable's security scans read your project's configuration and code, and flag things like tables with RLS off or policies that are always true. Here's what Preflight adds on top:

A live test with two real accounts. A policy like auth.uid() is not null looks reasonable and passes config checks, yet lets every signed-in user read everyone's rows. Only trying it shows that.
Your deployed site, not just your project. Headers, exposed files, bundle secrets, TLS and email DNS live on your host, outside your database and outside your editor.
One report, wherever you built it. The same checks for Cursor, Claude Code, Bolt, Replit or Lovable apps.

Four steps, no code upload

No repo access, no agent to install.

1
Paste your URL
Preflight reads what any browser can see: your pages, JavaScript bundles, response headers, certificate and DNS.
2
Prove it's yours
Add a DNS TXT record or a meta tag. Nothing is scanned until ownership is verified. No exceptions, including for us.
3
On Supabase? Add two test users
Create two throwaway accounts in your app and Preflight runs the cross-user read test. Not on Supabase? Skip this step; every other check still runs.
4
Paste the fix
Every finding shows how we know, then gives you an exact fix (SQL, header lines or config) and a ready prompt for your AI tool. Re-run to confirm it holds.

A finding looks like this

This is a sample from a demo app we broke on purpose. Real reports have the same shape: what failed, how we know, and what to paste.

Emergency · Cross-user read

sample · demo-notes.app

Test user A read 214 of test user B's notes

Criticaltable public.notespolicy "notes_select" · auth.uid() is not nullrows read: count only

RLS is on and notes has a select policy, so config checks pass. But the policy only asks "is someone signed in?", not "is this their note?". Anyone who signs up can read everyone's notes.

How we know

# signed in as test user A (redacted)
GET /rest/v1/notes?user_id=eq.<user B>&select=id
# response: 214 rows (ids hashed, contents never fetched)

Paste this SQL

drop policy "notes_select" on public.notes;
create policy "notes_select_own" on public.notes
  for select to authenticated
  using ( (select auth.uid()) = user_id );

Or paste this into your AI tool

# Prompt for Lovable / Bolt / Cursor / Claude Code
In Supabase, the notes table's select policy is
"auth.uid() is not null". Replace it so a signed-in user
can only select rows where user_id = auth.uid().
Don't change insert/update/delete policies.

Pricing

Everything below is coming soon. Nothing is for sale until the scanner passes its accuracy bar, and we'll publish that accuracy run, misses included. Joining the list is free and commits you to nothing.

Price list

USD · taxes may apply

Free scan

Every outside-in check on one verified app. You see every finding and its severity, with one in full detail.Coming soon

Proof Report

Every finding in full with how we know, exact fixes and AI-tool prompts, the Supabase cross-user read test, a Markdown export, and re-scans for 30 days. One app, one-time.Coming soon

$29

Monitor

Weekly re-scan of up to 3 apps, including the cross-user test, with an email when something new appears. Cancel anytime.Coming soon

$12/mo

Code tier

Later: read-only repo checks for what only code shows, like webhook signature verification, server routes that skip auth, secrets in git history and your dependency tree.Planned, not priced yet

Later

What Preflight will never do

A security tool that cuts corners is the problem it claims to solve. These are rules in the code, not promises in a footer.

Scan an app you haven't proven you ownDNS or meta-tag verification comes first, every time.
Download your users' dataWe count rows. We never store their contents.
Write, delete or change anythingEvery request is read-only. No load testing, no exploit chains.
Show a full secretKeys are masked in reports and never logged.
Pretend to be a penetration testPreflight runs automated checks and says what it didn't check. Apps handling sensitive data still need a professional review.
Fake a number on this pageNo invented users, reviews or countdowns. The demos above are labeled as demos.

Questions

My app doesn't use Supabase. Is this for me?

Yes. Leaked secrets, headers, exposed files, auth settings, vulnerable libraries, TLS and email DNS, and open Firebase rules work for any web app. The deep cross-user database test is Supabase-first. Firebase is next if enough people ask for it.

Doesn't Supabase already check this?

Supabase's Security Advisor is good and you should use it: it flags tables with RLS off, policies that are always true, and other configuration issues. It reads configuration. It doesn't sign in as two of your users and try to read across, and it doesn't look at your deployed site's headers, files or bundle. That's what Preflight adds.

Is this a penetration test?

No. Preflight runs automated, read-only checks from the outside, and every report lists what it didn't check. It can miss things. Apps handling sensitive data should also get a professional security review.

Do you need my code or my service key?

No. Preflight uses only what's public plus the two test accounts you create. Never paste a service-role key into any scanner, including this one. Code-level checks come later, in a separate read-only code tier.

When does it open?

When it passes its accuracy bar on deliberately vulnerable demo apps. It's being built in public during October and November 2026. You'll get one email when it opens.

Who's behind this?

Preflight is operated by Thomas Kanze, an indie developer in Costa Rica, and built in public as part of "30 days, the bot is the boss", a challenge where an AI agent runs the business. Questions: support@preflightbot.com.