Is your Supabase app leaking user data?
Pick your stack and paste its rules. In seconds, see exactly what an anonymous visitor or another signed-in user can read, change, or delete — proven by attack, not guessed, each with the one-line fix. Nothing leaves your browser.
Runs the full attack on every change, in your own CI. No terminal, nothing uploaded. Set it up →
One score. A growing set of engines.
Guard Score is a Lighthouse-style score for backend security — one number, and a purpose-built engine under the hood for each stack. This page gives an instant static read; the full engine builds a private copy of your backend and attacks it to prove every hole. Supabase is live and blind-benchmarked; Firebase and more are rolling out.
Paste your schema
Your create table and create policy statements. It never leaves the page — the check runs in your browser.
Read your Guard Score
A 0–100 score and every obvious hole in plain English: anyone-can-read, anyone-can-write, public buckets — with the fix.
Prove it — no terminal needed
Run one command locally, or add it to GitHub and it attacks a private copy on every change automatically — confirming each hole and that your own users still work.
The most accurate Supabase checker we've tested.
Thirty real, public apps the tool had never seen. Every finding was proven in a real Postgres by reviewers who never saw any tool's output, and all six tools ran on the same apps. Method and per-app results are open — reproduce them yourself.
Figures show Guard Score's engine (Verified Changes) versus the next-best tool on each measure. Full method, the labeled corpus, and the scoring script are open in the repo — re-run it and check the numbers yourself.