Pricing

from $4.65 / 1,000 security findings

Supabase RLS Security Scanner - Find Anonymous Data Leaks

Supabase RLS security scanner. Probes a public Supabase project for Row-Level-Security misconfigurations and detects tables readable by the anon key - the #1 cause of Supabase data leaks. Returns row counts + a curl reproducer per finding. Counts only, no row data exfiltrated. By Renzo Madueno.

Pricing

from $4.65 / 1,000 security findings

Rating

0.0

(0)

Developer

Renzo Madueno

Actor stats

Bookmarked

Total users

Monthly active users

4 days ago

Last modified

Categories

Developer tools

Supabase Project URL (leave empty for a DEMO sample report)

supabaseUrl

Optional

Your project URL, e.g. https://abc123xyz.supabase.co. Find it in Supabase Dashboard → Project Settings → API. Leave empty + click Run for a sample report showing what a real scan returns.

Type:string

Anon Key (public-side key, leave empty for DEMO)

anonKey

Optional

Your anon/public key (NOT service_role). The anon key is meant to be exposed in your frontend — that's the whole point of this scan: anything readable with the anon key is readable by anyone on the internet. Find it in Supabase Dashboard → Project Settings → API → 'anon public'. Leave empty for a demo sample.

Type:string

Extra table names to probe (optional)

tableHints

Optional

Beyond the default list of ~40 common tables (users, profiles, accounts, posts, etc.), pass additional table names specific to your schema you'd like checked. Comma-separated. The scanner will probe each one for anonymous readability.

Type:array

Default:

[]

Output format

outputFormat

Optional

JSON for programmatic use; HTML for a human-readable report stored to KV under report.html.

Type:string

Default:both

Options:

jsonhtml-reportboth

🪺 Nhost Security Scanner - Find Public Leaks

renzomacar/nhost-security-scanner

Probes a public Nhost project's Hasura GraphQL endpoint for tables readable by anon role. Detects the #1 cause of Nhost data leaks: forgotten Hasura permission policies. Returns table-level counts + curl reproducer. Counts only.

Renzo Madueno

🗃️ PocketBase Security Scanner - Find Leaks

renzomacar/pocketbase-security-scanner

Probes a public PocketBase instance for misconfigured collection rules. Detects collections readable without auth via /api/collections/*/records. Returns counts + curl reproducer. Counts only, no data exfiltrated.

Renzo Madueno

🚀 Strapi Security Scanner - Find Public Leaks

renzomacar/strapi-security-scanner

Probes a public Strapi instance for misconfigured Public role permissions. Detects content-types readable without auth via /api/{collection}. Returns counts + curl reproducer. Counts only.

Renzo Madueno

🧭 Directus Security Scanner - Find Leaks

renzomacar/directus-security-scanner

Probes a public Directus instance for misconfigured Public-role permissions. Detects collections readable without auth via /items/{collection}. Returns counts + curl reproducer. Counts only.

Renzo Madueno

🌐 WordPress Security Scanner - REST API User & Draft Leaks

renzomacar/wordpress-security-scanner

WordPress security scanner. Probes the WordPress REST API for endpoints leaking users, plugins, drafts and customer data - the misconfigurations attackers enumerate before a brute-force. 40% of the web runs WordPress. Counts only, no data exfiltrated. Fix guidance included. By Renzo Madueno.

Renzo Madueno

Supabase MCP SelfHosted

coupaul/Supabase-MCP-SelfHosted

🔒 Self-Hosted Supabase MCP Server - Enhanced Security Production-ready MCP server for self-hosted Supabase with enterprise security. Features SQL injection prevention, rate limiting, Docker optimization & direct DB access. Tools: database ops, auth, storage, types. Perfect for production!

Paul Roelens

job-scraper-supabase

raviskydive/jobscraper

Modular Apify actor that scrapes job listings from LinkedIn, Indeed, Glassdoor, and Monster, normalizes data, and optionally upserts results into Supabase for downstream use.

Ravi

🔗 Hasura Security Scanner - Find Anon Leaks

renzomacar/hasura-security-scanner

Probes a public Hasura GraphQL endpoint for tables readable by the anon role. Works for self-hosted, Hasura Cloud, and frameworks on top. Counts only.

Renzo Madueno

Supabase Automation Toolkit

waxlike_polecat/supabase-automation-toolkit

Save hours with Supabase automation. Export, cleanup, backup with simple JSON tasks. Schedule daily reports, remove inactive users, free up storage automatically.

Mohamed Ali DHIBA

Supabase API Database, Storage, Auth & Project Management

alizarin_refrigerator-owner/supabase-api-database-storage-auth-project-management

Access Supabase programmatically through this comprehensive API actor. Query and manage PostgreSQL databases, handle file storage, manage authentication users, and control projects - all through a single interface.