BreachProbe
Find out if your app leaks its database
Start new thread

BreachProbe - Find out if your app leaks its database

by•
BreachProbe scans an app you shipped with Lovable, Bolt, v0 or Supabase and tells you what it is serving the public. The free scan reads the shipped JavaScript for exposed keys, probes Supabase REST endpoints and checks security headers. The paid report adds what a passive scan cannot do: it signs up two throwaway accounts through your own signup endpoint and asks one, table by table, how many rows it can read. Read-only throughout, and every finding carries a written fix.

Add a comment

Replies

Best
Hunter
📌
Maker here. Every scanner I tried could tell me a table had a row-level-security policy on it, and none could tell me whether that policy actually worked. That is the bug that leaks the database — a policy that exists, passes the check, and still lets one signed-in user read another's rows. The only way to test it is to hold a session, so BreachProbe signs up two throwaway accounts through your own public signup endpoint and asks one of them, table by table, how many rows it can read. A correctly scoped table answers zero; anything above that belongs to somebody else. Nothing is written to your database and no row values leave your project. The free scan covers the passive checks — exposed keys, open REST tables, headers. The paid report adds the cross-tenant walk and a written fix per finding. Happy to answer anything.