Supabase Quick Scanner
Detect exposed Supabase API keys and data leaks by scanning website JavaScript. Enter any URL to check if it has vulnerable Supabase configurations.
How It Works
1. Fetch Website
We fetch the target website's HTML and discover all JavaScript files.
2. Scan JavaScript
Each JS file is analyzed for Supabase URLs, API keys, and configuration patterns.
3. Extract Credentials
Found Supabase project IDs, URLs, anon keys, and service role keys are extracted.
4. Test for Leaks
We query the discovered Supabase instance to check if data is publicly accessible.
5. RLS Assessment
Determine if Row Level Security is properly configured to protect sensitive data.
6. Report Findings
Get a detailed report with exposed tables, row counts, and remediation steps.
Need a Full RLS Audit?
Use our Supabase RLS Scanner for comprehensive policy testing with your database connection string.
Full RLS Scanner