← Supabase RLS exposure checker
VibeAppScanner is a hosted third-party service that scans Supabase and other AI-app-builder backends for security issues, including missing-RLS exposure, and returns a report. It is one of several services and write-ups that emerged from the same 2025-2026 wave of reporting on CVE-2025-48757 and the "170+ Lovable apps" incident this checker's own background page describes.
This checker does one narrower thing, differently. It reads your project's own PostgREST schema
listing (an OpenAPI document the anon key can already see), then sends one capped,
read-only GET per table it finds and reports which ones return real rows to that unauthenticated
request. The code is open source and readable in full before you trust it,
it runs entirely in your own browser tab (or as a Node CLI you can wire into CI), and it never
sends your project URL, anon key, or anything it reads back to any server of ours.
| What you are trying to do | Where to do it |
|---|---|
| Get a broader security report across more than RLS exposure, without reading any code yourself. | VibeAppScanner or a comparable hosted scanning service. |
| Check specifically whether the anon key can read real rows from any table, with the smallest possible trust surface (nothing sent to a third party, code you can read line by line). | This checker -- runs in your own browser, or as a CLI you control. |
| Gate a deploy in CI the moment a new table lands without RLS, unattended, on a runner where you would rather not hold a third-party API credential. | This checker's CLI -- exit code 1 on any exposed table. |
| Audit a client's or a third party's project where you are only comfortable running something you can fully inspect first. | This checker -- open source, no account, no hosted service seeing the key. |
| Want a managed dashboard, scheduled scanning, or support from a vendor. | VibeAppScanner or a comparable paid/hosted service -- this checker is a free, unattended, no-account tool with no dashboard. |
These are not mutually exclusive. A reasonable setup pairs a broader hosted scan run occasionally with this checker wired into CI as a tight, zero-trust-surface regression gate against the one exposure that has actually cost real incidents in 2025-2026: a newly created table with RLS left off.
They serve overlapping but differently-shaped needs. VibeAppScanner is a hosted, broader security-scanning service covering more than RLS exposure across Supabase and other AI-app-builder backends, aimed at a developer who wants a fuller report without reading any code. This checker does one thing -- reads your project's own schema listing and tests whether the anon key can read real rows from each table -- with source code you (or anyone) can read in full before trusting it, runs entirely in your own browser with nothing sent to a third party, and has a CLI you can wire into your own CI. Reach for a hosted scanner when you want a broader audit and are comfortable with a third-party service seeing your project URL and key; reach for this when you want the narrower RLS-read check with the smallest possible trust surface.
The anon key is meant to be public, but that does not make every use of it equally low-risk to hand to a third party: a hosted scanner still becomes a service that has your project URL and key on its own servers, logs, and infrastructure, subject to its own security and retention practices. This tool never receives either -- every request goes directly from your browser to your project's own REST endpoint, the same way your app's client already talks to it, and nothing about the run is sent to us or stored anywhere but your browser's local storage as an anonymous usage count.
No. This site is not affiliated with, endorsed by, or sponsored by VibeAppScanner, and VibeAppScanner is a trademark of its owner, named here only to describe what this checker is and is not. The description of VibeAppScanner on this page is drawn from its own public site; check it there for what its current scan covers.
Only point either tool at a project you own or are authorised to test. That rule is unchanged by which one you pick.