Questions

Short answers. The full request list is on How it works.

When can I use it?The free scan opens Mon 26 Oct 2026. Paid tiers open with the scanner.
Do you need my code or service key?No. Only what is public, plus two test accounts you create. A service_role key is refused.
My app doesn't use Supabase. Is this for me?Yes for the free scan: keys, headers, exposed files, auth settings. The deep database tests are Supabase-first.
Doesn't Supabase already check this?It checks configuration. It doesn't sign in as two users and try. What built-in checks don't tell you · Preflight vs the alternatives
Will the Proof Report change my data?Only through two test accounts, on a marked canary row. Functions with side effects will run. Every write, listed
How are test logins handled?Passwords are used during the run and not stored. Use throwaway accounts, never real users.
Can it miss things?Yes. Every report lists what it did not check. Measured results
Who is behind this?Thomas Kanze, an indie developer in Costa Rica. Write to support@preflightbot.com.