Security guides
Practical, tested guides for apps built on Supabase and with AI builders. Each one shows how to check the problem yourself, and what Preflight checks for you.
Free scan: GET and HEAD requests only, after you verify you own the domain. The two-account cross-user test is the $29 Proof Report.
01All guides
- Supabase RLS checkerTest row level security as no one, then as two users. SQL and curl included.
- Lovable security scanWhat Lovable’s Quick and Deep scans cover, and how to test the live app yourself.
- Supabase anon key exposed?Why the anon or publishable key is meant to be public, and what actually leaks.
- Supabase security checklist24 checks with SQL, grouped, each marked with whether Preflight tests it.
- Supabase service_role key leakedConfirm the leak, rotate without downtime, and check what was touched.
- Supabase storage: public vs private bucketsPublic vs private buckets, owner-folder policies, signed URLs and how to test them.
- Bolt.new security: before you publishWhat Bolt.new checks for you, what it can’t see, and how to test the live app.
- Vibe coding security checklist20 checks for apps built with AI tools, from data leaks to headers and email.
What an outside scan can't tell you
Can one user read another user's data?
Preflight signs in as two test accounts you create and tries to read one account's rows and files from the other. That cross-user test is the $29 Proof Report for Supabase apps. Start with the free scan: it checks your live app from outside with GET and HEAD requests only.