🔗 Hasura Security Scanner - Find Anon Leaks

Probes a public Nhost project's Hasura GraphQL endpoint for tables readable by anon role. Detects the #1 cause of Nhost data leaks: forgotten Hasura permission policies. Returns table-level counts + curl reproducer. Counts only.

Supabase RLS security scanner. Probes a public Supabase project for Row-Level-Security misconfigurations and detects tables readable by the anon key - the #1 cause of Supabase data leaks. Returns row counts + a curl reproducer per finding. Counts only, no row data exfiltrated. By Renzo Madueno.

Probes a public Strapi instance for misconfigured Public role permissions. Detects content-types readable without auth via /api/{collection}. Returns counts + curl reproducer. Counts only.

Probes a public Directus instance for misconfigured Public-role permissions. Detects collections readable without auth via /items/{collection}. Returns counts + curl reproducer. Counts only.

Anon Lab

bikrambiswas/anon-lab

Anon Lab is an open research workspace that transforms anonymity and privacy papers into readable explanations and executable code. Built on the Free Haven Anonymity Bibliography, it makes decades of privacy research interactive, reproducible, and usable for developers and researchers.

Probes a public PocketBase instance for misconfigured collection rules. Detects collections readable without auth via /api/collections/*/records. Returns counts + curl reproducer. Counts only, no data exfiltrated.

Probes a public Payload CMS instance for collections readable without auth. Default templates leave read access wide open during development.

WordPress security scanner. Probes the WordPress REST API for endpoints leaking users, plugins, drafts and customer data - the misconfigurations attackers enumerate before a brute-force. 40% of the web runs WordPress. Counts only, no data exfiltrated. Fix guidance included. By Renzo Madueno.

GraphQL Endpoint Extractor

datamule/graphql-endpoint-extractor

Point at ANY GraphQL endpoint: send a raw query (+ optional variables & headers) and flatten the chosen data path into dataset rows plus a lossless raw object — or introspect the schema to discover its types. Works with public or token-gated GraphQL APIs. Pay per record.

Probes a public Convex deployment for queries that return data without auth. Convex queries are public-by-default unless you check auth inside the handler. Returns counts + reproducer.