RLS Watch

For Lovable, Bolt, Replit, Cursor, and v0

Weekly security checks for the app you just shipped.

RLS Watch looks for the doors AI builders leave open: a secret key in the JavaScript, a Supabase table with row-level security off, a .env file on the public internet. Paste a URL you own. We read it, write nothing, and hand you a fix prompt you can paste back into Lovable or Cursor.

Start the free scanSee pricing

Or get a welcome note and stay on the list.

criticalSample

Stripe secret key in the shipped JavaScript

The file the browser downloads contains a Stripe secret key. Anyone who can open the app can copy it and create refunds or charges. Removing it from the project is not enough. Rotate the key in Stripe, and keep the new one on the server.

1 match in /assets/index-B7Q.js. Example: sk_live…9k2Q.

Paste into Lovable

You are editing this Lovable project. Make the smallest change that fixes the issue. Do not add features.

The browser bundle contains a Stripe secret key (/assets/index-B7Q.js).

1. Remove every sk_live_, sk_test_, and rk_live_ key from client code and public env vars.
2. Create the Checkout Session on the server. The browser only receives the session URL Stripe returns.
3. Rotate the key in the Stripe dashboard now. Treat the old key as public.
4. Keep the publishable key (pk_) in the browser if you need it. Never the secret key.

Paste into Cursor

You are editing this repository in Cursor. Make the smallest change that fixes the issue. Do not add features.

The browser bundle contains a Stripe secret key (/assets/index-B7Q.js).

1. Remove every sk_live_, sk_test_, and rk_live_ key from client code and public env vars.
2. Create the Checkout Session on the server. The browser only receives the session URL Stripe returns.
3. Rotate the key in the Stripe dashboard now. Treat the old key as public.
4. Keep the publishable key (pk_) in the browser if you need it. Never the secret key.

What the full check looks for

Before you prove the site is yours, we only read the public page. Everything below waits for a meta tag, a /.well-known file, or a DNS TXT record.

  • Keys in the JavaScript

    OpenAI, Stripe secrets, Supabase service_role, AWS, GitHub, private keys.

  • Supabase with RLS off

    A read-only select, limit 1, using the anon key. We never write.

  • Firebase open rules

    A shallow read of Realtime Database, and one Firestore page.

  • Public .env and .git

    The files that get uploaded when a build ships the working tree.

  • Open CORS

    A foreign Origin that the server reflects, especially with credentials.

  • Headers and mixed content

    Missing browser seatbelts, and http:// assets on an https page.

Free once. Then a credit when you want another check.

First scan

$0included

  • One credit on the new account
  • Full report after you prove the app is yours
  • Plain English, plus a fix prompt
Use the free scan

Single scan

$8one credit

  • One more full check, any verified app
  • Use it the day you ship, or save it
  • The Monday job can spend it
Buy one scan

10-scan pack

$19ten credits

  • Ten full checks
  • Up to 10 apps on one account
  • Email when a report changes
Buy the 10-pack

We do not scan a site you have not claimed.

Add the app, tick the box that you own it or were asked to scan it, then publish a token we give you. Until that token shows up, the only request is one passive read of the public page. The full check is still read-only: no logins, no form posts, no database writes.

After you ship an update
Spend a credit the day you ship. The Monday job spends one credit per app, and emails you to top up when the balance is zero.
Email when something changes
The digest names what is new and what cleared. The first report stays in the app until the next one differs.