Pricing

from $4.65 / 1,000 security findings

Try for free

Go to Apify Store

🪺 Nhost Security Scanner - Find Public Leaks

Try for free

Probes a public Nhost project's Hasura GraphQL endpoint for tables readable by anon role. Detects the #1 cause of Nhost data leaks: forgotten Hasura permission policies. Returns table-level counts + curl reproducer. Counts only.

Pricing

from $4.65 / 1,000 security findings

Rating

0.0

(0)

Developer

Renzo Madueno

Actor stats

Bookmarked

Total users

Monthly active users

7 days ago

Last modified

Configure MCP server with 🪺 Nhost Security Scanner - Find Public GraphQL Data Leaks

The configuration above connects to the hosted Apify MCP server with the 🪺 Nhost Security Scanner - Find Public GraphQL Data Leaks Actor already loaded. It uses OAuth, so your client opens a browser window to sign you in to Apify on first use. No API token is needed. Clients without OAuth support can authenticate with an Authorization: Bearer header carrying an API token from API & Integrations in Apify Console.

Get a ready-to-use configuration for your MCP client with the 🪺 Nhost Security Scanner - Find Public GraphQL Data Leaks Actor preconfigured at https://mcp.apify.com/?tools=fetch-actor-details,renzomacar/nhost-security-scanner.

You can connect to the Apify MCP Server using clients like Tester MCP Client, or any other MCP client of your choice.

If you want to learn more about our Apify MCP implementation, check out our MCP documentation. To learn more about the Model Context Protocol in general, refer to the official MCP documentation or read our blog post.

🔗 Hasura Security Scanner - Find Anon Leaks

renzomacar/hasura-security-scanner

Probes a public Hasura GraphQL endpoint for tables readable by the anon role. Works for self-hosted, Hasura Cloud, and frameworks on top. Counts only.

Renzo Madueno

Supabase RLS Security Scanner - Find Anonymous Data Leaks

renzomacar/supabase-rls-scanner

Supabase RLS security scanner. Probes a public Supabase project for Row-Level-Security misconfigurations and detects tables readable by the anon key - the #1 cause of Supabase data leaks. Returns row counts + a curl reproducer per finding. Counts only, no row data exfiltrated. By Renzo Madueno.

Renzo Madueno

🚀 Strapi Security Scanner - Find Public Leaks

renzomacar/strapi-security-scanner

Probes a public Strapi instance for misconfigured Public role permissions. Detects content-types readable without auth via /api/{collection}. Returns counts + curl reproducer. Counts only.

Renzo Madueno

🧭 Directus Security Scanner - Find Leaks

renzomacar/directus-security-scanner

Probes a public Directus instance for misconfigured Public-role permissions. Detects collections readable without auth via /items/{collection}. Returns counts + curl reproducer. Counts only.

Renzo Madueno

🗃️ PocketBase Security Scanner - Find Leaks

renzomacar/pocketbase-security-scanner

Probes a public PocketBase instance for misconfigured collection rules. Detects collections readable without auth via /api/collections/*/records. Returns counts + curl reproducer. Counts only, no data exfiltrated.

Renzo Madueno

⚡ Convex Security Scanner - Find Public Leaks

renzomacar/convex-security-scanner

Probes a public Convex deployment for queries that return data without auth. Convex queries are public-by-default unless you check auth inside the handler. Returns counts + reproducer.

Renzo Madueno

📦 Payload CMS Security Scanner - Find Leaks

renzomacar/payload-security-scanner

Probes a public Payload CMS instance for collections readable without auth. Default templates leave read access wide open during development.

Renzo Madueno

Website AI Content & Data Leakage Scanner

glowing_glove/website-ai-content-data-leakage-scanner

Find public AI-readable content exposure, sensitive document links, open indexes, sitemap leaks, llms.txt hints, and risky crawl surfaces.

Ushba Khan

🌐 WordPress Security Scanner - REST API User & Draft Leaks

renzomacar/wordpress-security-scanner

WordPress security scanner. Probes the WordPress REST API for endpoints leaking users, plugins, drafts and customer data - the misconfigurations attackers enumerate before a brute-force. 40% of the web runs WordPress. Counts only, no data exfiltrated. Fix guidance included. By Renzo Madueno.

Renzo Madueno

ICIJ Offshore Leaks Database Exporter

logiover/icij-offshore-leaks-scraper

Export entities, officers, intermediaries, addresses and relationships from ICIJ's Offshore Leaks Database for AML/KYC, due diligence and investigative research. Filter 800K+ records without an API key.