Hi all,

  
We’ve been working on **LeakScope** for a while now and recently updated it quite a bit.  
  
We didn't build LeakScope because we wanted *another security scanner*.

  
We built it because after manually reviewing Supabase applications, we kept running into the same problems: weak RLS policies, overly permissive access rules, exposed frontend configuration, and data that developers didn't realize was publicly accessible.  
  
**LeakScope** is an automated security scanner designed specifically for developers and indie hackers building applications with Supabase. It helps identify critical backend vulnerabilities—such as weak Row-Level Security (RLS) policies, exposed database tables, and API keys hidden in frontend code—simply by pasting your website's URL.

So far, LeakScope has:

*  Scanned **1,982** websites
*  Identified **13,834** security findings

  
We're still actively improving it, and we'd genuinely love feedback from developers and founders.

  
**If you're building with Supabase, what would you want a tool like this to detect or do?**  
  
Whether that's generating RLS policies, exporting pgTAP tests, CI/CD integration, monitoring production changes, or something else. We'd love to hear your thoughts.  
  
The scanner was developed with mainly with **Claude Sonnet & Opus** and **Codex 5.5 / 5.4 (xhigh/high)** for designing, implementing, and refining the detection logic, with **Gemini 3.1** (using both high- and low-reasoning modes) helping explore ideas and validate approaches during development.

We're also planning to leverage the **Gemini API** to generate contextual remediation guidance, providing developers with actionable recommendations tailored to each security finding.

If you want drop your site we will scan and let you know the results or see what your Supabase app exposes from the outside yourself at [leakscope.tech](http://leakscope.tech) if you sign up now you get access to our deep scanner essentially free penetration testing for you :)

See what your app built with Supabase backend exposes from the outside. Drop your URL and we’ll scan it