Scan your Supabase site before you ship
Supabase apps call the database straight from the browser using a public key, protected by Row Level Security. That design is safe only when the right key is in the browser and RLS is on.
Free · No signup · Only scan sites you own or have permission to test
Common Supabase launch issues
🛡️ Security
- The anon / publishable key (sb_publishable_) is meant to be public; the service_role key and sb_secret_ keys are admin keys that bypass RLS and must never ship to the browser.
- ChillScan detects service_role JWTs by decoding the token's role claim, and flags sb_secret_ keys as critical.
- Other keys (OpenAI, Stripe) used by the app should live in Edge Functions, not front-end code.
🔎 SEO
- Supabase is a backend, so SEO depends on your front end; client-rendered apps may be blank to crawlers.
⚡ Performance
- Data fetched only in the browser after load delays content; ChillScan measures the HTML response and JS weight, not database queries.
What ChillScan checks on your Supabase site
- ✓ Supabase service_role and sb_secret_ keys in your JS
- ✓ Other leaked API keys
- ✓ Security headers, HTTPS and cookies
- ✓ SEO and performance of the front end
ChillScan can't see whether Row Level Security is enabled on your tables. It only reads what the browser receives, so check RLS in the Supabase dashboard too.
ChillScan reads only what a visitor's browser receives. It doesn't run JavaScript and can't scan pages behind a login or bot protection. See every check → · See a sample deep report →