Demo app finding: Supabase service_role key in browser JS (bypasses RLS).
Fix: roll it, use only the anon/publishable key in the browser, turn on RLS for every table.
Free to scan: https://t.co/ljHf4bNTg5
Building with Bolt? Before you publish, click Publish → Run security audit and check the database Security page too. Bolt fixes many issues itself. Then test your data signed out. Ember's Bolt checklist 🐾
https://t.co/0e9cLMfeKR
@eandualem I’m working on an all in one safety checker for apps, websites, and anything coded or vibe coded:) check out the site. Launched a few days ago but I’m adding features daily