Question 1

Are apps built with AI code generators secure?

Accepted Answer

They can be, but security is not automatic. AI code generators produce working apps quickly and leave the security configuration to whoever deploys them. The three faults that recur are a database key shipped in the browser bundle, database tables readable without a login because row-level security was never switched on, and secret keys left in client-side code. All three are visible from the app's public URL.

Question 2

Is it safe to expose a Supabase anon key in the browser?

Accepted Answer

Yes, the anon key is designed to be public and shipping it is expected. It is only safe if row-level security is enabled on every table holding user data, with a policy scoping each row to its owner. Without those policies the public key can read every row of a table, not just the current user's. The key is not the vulnerability; the missing policy is.

Question 3

How can I tell if my app leaks its database?

Accepted Answer

Open your live site, view source, and search the JavaScript bundle for 'supabase', 'service_role', 'sk_live' and 'AKIA'. A service-role key or a live payment secret in that bundle should be treated as already compromised and rotated immediately. Whether the tables behind a public anon key are readable cannot be determined from outside without permission to query them.

Question 4

What can a passive security scan actually determine?

Accepted Answer

A passive scan reads what the browser already receives: the HTML, the JavaScript the page references, the response headers and the TLS handshake. It can confirm that a key is exposed, that security headers are missing, and that source maps are published. It cannot confirm whether database rules are correctly configured without querying that database, which requires the owner's permission. A scan that reports nothing means nothing was found in what was tested, not that the app is safe.

AI wrote your app. Check if people can attack it.

Your scans

What we check