AI tools produce working Supabase + Next.js apps quickly, and a lot of them go live with the database readable by anyone. CVE-2025-48757 covered 170+ apps with exactly this problem: Row Level Security missing or misconfigured.
The idea
One command that audits a project and prints what to fix:
- tables with RLS disabled
- policies that let everyone in, like
USING (true) - the
service_rolekey in client code or public env vars - API routes that read the database with no auth check
- webhooks with no signature verification
- public storage buckets
It would also ship skills that let Claude Code or Cursor apply the fixes. The core would be free and open source, with a paid version at $29–$49 one-time.
Where it stands
I have not written it yet. I'm testing demand first. My bar is 20 waitlist signups in 7 days; if it misses, I move on to the next idea.
What I'd like to know
- What do you check by hand before launching a Supabase app today?
- Which of these checks would you not trust a tool to get right?
- Would you pay for this, or is a free checklist enough?
There is nothing to buy. If you want one email when it launches, the waitlist is here: https://shipaudit-ebon.vercel.app
Top comments (0)