PocketBase Security Scanner — Find public collection leaks

Probes a public Appwrite project for collection permission misconfigurations. Detects collections readable by guest role via /v1/databases/*/collections/*/documents. Returns counts + curl reproducer. Counts only, no data exfiltrated.

Probes a public Firebase project for misconfigured Security Rules. Detects Firestore collections and Realtime Database paths readable without auth — the #1 cause of Firebase data leaks. Returns counts + curl reproducer per finding. Counts only, no data exfiltrated.

Audit any PocketBase instance for collections with empty (public) list/view/create/update/delete rules and over-permissive endpoints. Active anon fetch confirms live leaks. HTML report with paste-ready collection rule snippets. Free.

Probes a public Supabase project for Row-Level-Security misconfigurations. Detects tables readable by the anon key — the #1 cause of Supabase data leaks. Returns row counts + a curl reproducer per finding. Counts only, no row data exfiltrated.

Probes a public Nhost project's Hasura GraphQL endpoint for tables readable by anon role. Detects the #1 cause of Nhost data leaks: forgotten Hasura permission policies. Returns table-level counts + curl reproducer. Counts only.

Shopify Scraper - Products, Collections, Analysis

prodiger/shopify-scraper

Scrape products and collections from any Shopify-powered store. Pay-per-event pricing — only pay for the items you actually scrape. No API key needed.

Audit any Appwrite project (cloud or self-hosted) for collections with over-permissive document-level permissions, public reads, and anonymous writes. Active anon fetch confirms live leaks. HTML report with paste-ready fix snippets. Free.

Shopify Scraper — Products, Collections, Reviews & Emails

khadinakbar/shopify-all-in-one-scraper

Extract Shopify products, collections, reviews & merchant emails from any store. No login required. CRM-ready JSON $3.00/1K.

Magic Eden NFT Collection Scraper

parseforge/magic-eden-nft-scraper

Scrape Solana NFT collections from Magic Eden public API. Returns collection metadata, social links, floor price, listed count, 24h avg price, total volume, and (optional) per-collection active listings. No API key required.

Static analyzer for firestore.rules + live anonymous probe. Detects 'if true' wide-open rules, expired test-mode, auth-only patterns, open storage. HTML report with paste-ready fix snippets. Free demo mode if you don't have rules handy.