Security for apps built on Supabase
Supabase lets you build fast, and that speed is also how security steps get skipped. The free Surface Check detects your Supabase project and maps your external security surface, then points you to the deeper risks, whether your tables are readable without a login, plus writes, storage and app logic, that a full review reaches.
Fast to build, easy to expose
Supabase hands you a database, authentication and APIs in minutes. The trade-off is that the safe configuration is yours to get right. The gaps we see most often in Supabase apps are a database table left publicly readable, an API key doing more in the browser than it should, and the ordinary web hardening, HTTPS, security headers, email anti-spoofing, that simply never got set up.
The outside view can’t see this
What the outside view still can't reach: writes, storage and app logic
The free Surface Check detects your Supabase project from your front-end, but it is an outside-in check. Whether your tables are readable without a login (a missing Row Level Security policy), who can write or change that data, whether your storage buckets are locked down, and the access-control logic inside your own app, the kind of flaw where an id you change in a URL returns another customer's record, all need the project and the code looked at directly, which a full review does.
What the free Surface Check covers for your Supabase app
- HTTPS and HSTS on your custom domain, so traffic can't be silently downgraded to plain HTTP.
- Security headers (Content-Security-Policy, clickjacking protection, nosniff) on your front-end.
- Your TLS certificate's health and how soon it expires.
- Cookie flags (HttpOnly, Secure, SameSite) on any session or auth cookies you set.
- Email spoofing: SPF, DKIM and DMARC on your domain, so attackers can't send email as you.
- Exposed secrets: common API keys or tokens (such as a Supabase service_role or Stripe secret key) left in the front-end code your site serves to browsers.
See your external surface in about a minute
A free, passive snapshot with an A-to-F Surface Score and every issue scored by severity and fix effort. No sign-up. We record which domain was checked and keep anonymous result statistics; see our privacy policy.
Run the free Surface Check →Frequently asked
Does the Surface Check log into my Supabase project?
No, it never logs in and never uses a secret key. The scan is passive: response headers, TLS, cookie flags and public DNS records, plus detecting that your app uses Supabase from your front-end. It never queries your database, never reads your actual data, and never writes or changes anything. Testing whether your tables are readable without a login is part of a full Secvura review.
Will it tell me if my tables are publicly readable?
Not from the outside. The free check detects your Supabase project from your front-end, but testing whether your tables are readable without a login (the classic missing Row Level Security policy), who can write to them, and the access-control logic in your own code is part of a full Secvura review.
We built the app with an AI tool on top of Supabase. Does that change anything?
It raises the odds. AI-generated apps ship quickly and often leave RLS off or an over-powered key in the browser, precisely because the security step is the easy one to skip. It is worth checking your external surface now, and your database access with a full review.
Is the check really free?
Yes, free and with no sign-up. You get an A-to-F Surface Score and every issue scored by severity and fix effort, the same way we score a full report.
More free checks
Go deeper than the free check on your Supabase app
A full Secvura Application Security Review is a hands-on assessment that reaches the inside risks an external check can’t: who can write or change your data, your storage and access-control logic, and the flaws that actually cost teams real money, with a clear plan your team can act on the same day.
£1,200
fixed price · report in 1–2 weeks · reply within one working day
Not ready? Start with the free Surface Check and see the quality of the findings first.