Built with Supabase
Check a site backed by Supabase
Supabase is well built and the common failure is not a flaw in it. It is that the difference between the anon key and the service role key is not obvious until somebody explains it — and AI builders routinely reach for whichever one makes the error stop.
Free website audit — no account
Find out what your website is giving away.
Paste your address. In about a minute you will see everything that is exposed, broken, or quietly costing you customers — and the exact fix for each one.
Not ready
Two things here need fixing before anyone visits.
Your payment password is visible to anyone
It is sitting in your website’s code, where any visitor can read it.
A settings file can be downloaded by anyone
It contains the keys to your database.
Your security certificate expires in 9 days
Visitors will see a red warning page when it does.
Google is told not to show 4 of your pages
Almost certainly a mistake left over from building the site.
7 pictures have no description
People using a screen reader cannot tell what they are.
What tends to go wrong on Supabase
None of this means you did something careless. These are the defaults.
The service role key in the browser
The anon key is meant to be public and is safe when your row-level security is right. The service role key bypasses row-level security entirely. If it reaches the browser, every row in your database is readable and writable by anyone.
Row-level security never switched on
A table with RLS disabled is readable through the public API with the anon key alone, no matter how careful your application code is.
Policies that were loosened to unblock a build
A policy relaxed to make something work during development, and never tightened, is indistinguishable from no policy at all.
Storage buckets left public
A bucket set to public serves every object in it to anyone with the URL pattern, including uploads you assumed were private.
Every fix is written for plain English
Findings do not stop at telling you something is wrong. Each one comes with the change to make, in five versions — including one you can paste straight into a message to whoever built it and one written with no jargon at all.