Guide3 min readUpdated 2026-08-10

Security checks you can run on your own site

Hands-on checks you can run from a browser or a terminal in two minutes each.

Every page here answers one question about your own app, with a check you run yourself rather than a claim you have to trust. No account, no install — a browser and a terminal are enough.

They are written for apps built with AI coding tools, where the frontend usually talks to the database directly. That design puts the entire security burden on settings most people never open.

Start with the database

If you only do one thing, do the Row Level Security check. An open database is the single most common serious problem in AI-built apps, and it is the one that exposes real user records rather than making an attack theoretically easier.

The 60-second version

  1. 1Open your live app, press F12, Network tab, reload.
  2. 2Click any request to *.supabase.co and copy the apikey header value.
  3. 3Run the query below against a table you know holds user data.
  4. 4An empty array means you are fine. Rows mean that table is public.

Ask your own database as a stranger

curl "https://YOUR-PROJECT.supabase.co/rest/v1/profiles?select=*&limit=3" \
  -H "apikey: YOUR_ANON_KEY" \
  -H "Authorization: Bearer YOUR_ANON_KEY"
Or hand the whole audit to your AI
Audit my project's security configuration and report what is wrong.

1. Supabase: for every table, is Row Level Security enabled, and does each
   policy actually restrict anything? Flag any policy whose USING clause is
   unconditional — those pass a naive check while allowing everyone.
2. Keys: list every credential reaching the browser bundle. Separate the
   ones that are public by design (Supabase anon key, Firebase apiKey,
   Stripe publishable key) from real secrets that must move server-side.
3. Routes: which API routes answer without checking who is asking?

For each problem give me the file, the exact fix, and how I verify it
afterwards from outside the app.

This is one check out of 40+

Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.

Check my site — free