Built a 1-day MVP that scans Vercel/Supabase apps for bad RLS and leaked secrets. Roast it?
by•
I build on Vercel + Supabase a lot. Shipping is easy. Messing up RLS is also easy.
What pushed me: I was using an LLM with MCP/plugins to help with policies. It got stuck, then disabled RLS "temporarily." Yeah. Temporarily.
There are a ton of vibe-coded apps on Lovable, Base44, etc. on the same stack. Same risk: anon key in the client, policies that look fine until they aren't.
So I spent a day on hackymacky. Paste a URL. It checks the client bundle for secrets and probes anon Supabase permissions.
MVP is rough. Looking for honest feedback:
Is this a real problem for you, or already solved somehow?
What would you want scanned that this doesn't cover yet?
Anything about the flow that feels dumb or unnecessary?
13 views
Replies