Sentris - Repo-deep security scanner for AI-built Supabase apps

Sentris scans your Supabase repo, not just the live URL — the two are not the same thing. Missing RLS policies, service_role keys hardcoded in source, public storage buckets, routes that take an id and never check who is asking, security definer functions anyone can call. Every finding comes with masked evidence — the exact line, row counts, status codes — and a copy-paste fix. I scanned 2,144 public vibe-coded repos while building it: 40.6% had a critical exposure. Free scan, no login.

I kept seeing the same thing in public vibe-coded repos: a Supabase project shipped fast, and the database left wide open. So I scanned 2,144 of them. 40.6% had at least one critical exposure. 38.9% had tables with no RLS at all. 9% had a service_role key sitting in the source. Every scanner I tried only looked at the live URL. But a missing RLS policy, a leaked service_role key, a public storage bucket, a route that takes an id and never checks who's asking — none of that is visible from the outside. It's in the repo. So Sentris reads both. Connect your GitHub repo (or just paste a URL for a quick pass) and you get findings with masked evidence — row counts, status codes, the exact line — plus a copy-paste fix. No exploits, no customer data, nothing you can't hand to a client. The rule I built it on: precision over recall. A clean repo has to come back with zero findings, or the report is noise and you stop reading it. $19/mo, one target, unlimited re-scans and weekly monitoring so you know when something new breaks. Free scan needs no login. Would love to hear what it finds in yours — especially if it finds nothing. That's a result too.

Sentris - Repo-deep security scanner for AI-built Supabase apps

Replies