I kept seeing the same thing in public vibe-coded repos: a Supabase project shipped fast, and the database left wide open. So I scanned 2,144 of them. 40.6% had at least one critical exposure. 38.9% had tables with no RLS at all. 9% had a service_role key sitting in the source. Every scanner I tried only looked at the live URL. But a missing RLS policy, a leaked service_role key, a public storage bucket, a route that takes an id and never checks who's asking — none of that is visible from the outside. It's in the repo. So Sentris reads both. Connect your GitHub repo (or just paste a URL for a quick pass) and you get findings with masked evidence — row counts, status codes, the exact line — plus a copy-paste fix. No exploits, no customer data, nothing you can't hand to a client. The rule I built it on: precision over recall. A clean repo has to come back with zero findings, or the report is noise and you stop reading it. $19/mo, one target, unlimited re-scans and weekly monitoring so you know when something new breaks. Free scan needs no login. Would love to hear what it finds in yours — especially if it finds nothing. That's a result too.

Sentris

Repo-deep security scanner for AI-built Supabase apps

Repo-deep security scanner for AI-built Supabase apps