Row Level Security on every table
In Supabase, every table with user data needs RLS turned on and policies tied to the signed-in user. Sign in as customer B and try to read, change or delete customer A’s row.
RLS OFF: THE PUBLIC KEY READS THE TABLE SECURITY CHECKLIST FOR APPS BUILT WITH AI
Vibe coding security checklist.
An app built with Lovable, Bolt, Base44 or Cursor can work perfectly and still show one customer’s data to another. Before launch, check these 10 places: database access rules (Supabase RLS, Firebase rules), keys in the code, admin and API without login, files, payments, login and input.
Bugs + vulnerabilities — $499 instead of $648. No bug found — 100% back.See a sample report- CVE-2025-48757: 170 OF 1,645 LOVABLE APPS HAD WRONG DATABASE ACCESS RULES
- ESCAPE · OCTOBER 2025: 400+ EXPOSED SECRETS IN 5,600+ APPS BUILT WITH AI
THE CHECKLIST10 checks.
10 checks.
Before you launch.
Sign in as a second customer and try to reach the first one’s data. Only on your own app.
01 / DATABASE 02 / KEYS No secret keys in the browser
The Supabase anon key may be public. The service_role key, Stripe secret keys and AI provider keys must never reach the front end — and anything in a VITE_ or NEXT_PUBLIC_ variable does. Search the loaded scripts for them.
A SECRET KEY IN THE JAVASCRIPT03 / ADMIN The admin page checks on the server
Hiding the admin button is not protection. Open the admin address signed out and as an ordinary customer.
THE ADMIN OPENS BY ITS ADDRESS04 / API Every API route checks who asks
Call your API or edge functions without a token, then with another customer’s ID. The answer must be a refusal, not data.
ANOTHER ID RETURNS ANOTHER’S DATA05 / FILES Private files stay private
Invoices, photos, documents: keep them in a private storage bucket with expiring links. Open a file’s address in a private window.
PRIVATE FILES IN A PUBLIC BUCKET06 / PAYMENTS Paid access only after a confirmed payment
Grant access only after your server confirms the payment — a webhook with a checked signature or a check with the payment provider — not just because the “success” page opened. Open that page without paying.
THE SUCCESS PAGE GIVES ACCESS07 / LOGIN Login attempts are limited
Enter a wrong password twenty times. You should be slowed down or stopped, and the message should not say whether the e-mail exists.
UNLIMITED PASSWORD GUESSES08 / INPUT What people type stays text
Put
A COMMENT RUNS CODE<img src=x onerror=alert(1)>into a name or comment field and open the page where it shows, especially in the admin.09 / ERRORS Errors don’t show the insides
Break a request on purpose. The app should show a plain message, not a stack trace, a database error or settings.
A DATABASE ERROR ON THE SCREEN10 / SECRETS Secrets stay out of the repository
No .env file in a public repository or on the server’s public folder. If a key ever leaked, rotate it — deleting the file is not enough.
A LEAKED KEY WORKS UNTIL REPLACED
BEYOND THE LISTA checklist finds the obvious.
A checklist finds the obvious.
A specialist finds the rest.
Our cybersecurity specialist tries to break into your app the way a hacker would — non-destructively and only with your permission.
Run the scanners too
Built-in and automated scanners catch known patterns in code and settings. Run them — and then check what only a signed-in second customer can show.
Vulnerability testing
Other people’s data and files, database access rules, keys in the code, admin and API without login, forged payments, password guessing. $349 on its own.
Bugs + vulnerabilities
Bug testing and vulnerability testing together for $499 instead of $648. It is not a pentest: a full penetration test is a separate service under contract.
PRICINGStart with a release.
Start with a release.
Take it from there.
Fixed prices. You see the total before you pay — nothing is charged without your decision.
THE WHOLE APP · UP TO 25 SCREENS
Bug testing
The first test of your app.
$299/ 1 platform
Order bug testing — $299 - The whole app — up to 25 screens or pages
- 5 main scenarios and all roles
- Real devices: computer and phone
- Test report: every bug with a screenshot and an AI prompt
- 14 days of retests
No bug found — 100% back
FOR APPS WITH PAYMENTS OR PERSONAL DATARECOMMENDED
Bugs + vulnerabilities
Bugs + break-in attempts, the way a hacker would.
- Everything in Bug testing
- Other people’s data and files
- Database access rules (Supabase, Firebase)
- Keys in the code, admin and APIs without login
- Forged payments and password guessing
No bug found — 100% back
SAVE UP TO $347
Testing subscription
For regular releases.
- 4 tests in 30 days: the first for bugs, then of your updates
- The whole app — up to 25 screens or pages
- 5 main scenarios and all roles
- Real devices: computer and phone
- A report for every test, plus retests of your fixes
No bug found — 100% back
Update testing — $149. For an app we have tested before. Order update testing ↗︎
Vulnerability testing — $349. Without bug testing. Order on its own ↗︎
Options. One more platform — +$149. 25 more screens — +$149. Rush report within 1–2 business days — +$99.
QUESTIONSFrequent
Frequent
questions.
Is the Supabase anon key safe in the browser?
Yes, it is meant to be public — but only when Row Level Security protects every table. The service_role key skips those rules and must never reach the browser.
What should I do if I find a leak?
Close it first: turn on RLS or fix the rule, move the key to the server. Then rotate every key that was exposed — a leaked key stays usable until you replace it. Then check again as a second customer.
Is this a pentest?
No. The checklist and our vulnerability testing are non-destructive break-in attempts on your app with your permission. A full penetration test is a separate service under contract.
How much does your vulnerability testing cost?
$349 on its own, or $499 in “Bugs + vulnerabilities” together with bug testing (separately $648). The report lists every finding with steps, a screenshot and an AI prompt to fix it.