YOUR LOGIN SCREEN ISN’T A DATABASE LOCK.
Free check in 60 seconds. Only for apps you own.
SCROLL TO WITNESS AN EXPOSURE| TABLE | ROWS | ANONYMOUS ACCESS |
|---|---|---|
| profiles | 12,408 | READABLE BY ANYONE |
| messages | 88,112 | READABLE BY ANYONE |
| orders | 3,201 | READABLE BY ANYONE |
| admin_notes | — | LOCKED |
3 tables readable by anyone on the internet.
Now check yours ↓ILLUSTRATION ONLY. Fake app. Invented counts. No real data accessed.
No account. No access to your rows.Start with the URL in the terminal prompt above.HTTPS only. Use the exact hostname your homepage runs on.
Add either proof to , publish it, then run your check. We look at the root homepage, even if you entered a longer URL.
Add this to your homepage’s <head>.
Serve a plain text file at:
Its entire contents should be:
Copy-paste prompts for Lovable, Cursor, or Bolt. Includes SQL templates where relevant.
Unlock fix prompts — $79Checkout isn’t configured yet. If you already purchased, enter your license key below.
Unlocking runs a fresh ownership check and scan.
This checks public client source and anonymous counts. A clean result does not guarantee your app is secure.
Scans only run after you prove you own the site. We never read or store your data — only counts.
THE VIEW FROM THE OTHER SIDE
RECONNAISSANCE / THE ATTACK SURFACE
What we check: the public surface of your app, from the browser’s point of view.
Secrets and Supabase credentials shipped in public client code. Public anon keys are expected; privileged secrets aren’t.
Tables that let anonymous visitors through. We check access using counts, without retrieving the rows.
Supabase storage buckets exposed through your public app. Know which doors are open.
Browser security headers missing from your homepage. The guardrails your users’ browsers rely on.
HOW IT WORKS / AUTHORIZED ACCESS ONLY
01 → 02 → 03
YOUR APP. YOUR CONTROL.
Your live app URL. Built with Lovable, Cursor, Bolt, or code you wrote yourself.
Publish a meta tag or a small verification file. No scan runs until ownership is verified.
Get your free exposure report. If something’s open, unlock prompts to help you fix it.
WHAT WE NEVER DO / THE RULES OF ENGAGEMENT
We check anonymous access without retrieving the records behind it. Your users’ data stays where it belongs.
A focused exposure check. A clear boundary.
WARDEN / TERMINAL RECEIPT
Ownership verification. Findings. Severity report.
One-time. Tailored to your findings. Ready for your coding tool, with SQL templates where relevant.
Preview a fictional fix prompt ↗
HELP / READ BEFORE RUNNING
Yes. An anon key in browser code is expected. The important question is what it lets an anonymous visitor access. Warden checks access and flags privileged secrets separately.
No. Table checks request counts, never rows. Warden does not read or store your database records. You must prove ownership before any scan runs.
No. This is a focused check of public client code, anonymous access, public buckets, and homepage headers. It does not replace a full security review. Scan notes explain checks that could not be completed.
Fix prompts tailored to the findings in your report, ready to paste into your coding tool, with SQL templates where relevant. It is a one-time purchase. You review and apply the changes.