Is your Supabase data locked down? Check before real users show up.
AI tools and fast builds get an app working quickly. They don't always lock it down. Our $469 audit is a human-reviewed check of the places small apps most often leak: database rules, keys, sign-in and payments. You get a written report of what we found.
What the audit covers
- Supabase Row Level Security (RLS): whether every table has RLS on, and whether the policies actually stop one user reading or changing another user's data.
- Exposed keys and secrets: service-role keys, API keys and tokens in front-end code, the repo or its history.
- Auth: sign-up and login settings, redirect URLs, email confirmation, sessions, and routes that should need a login but don't.
- Payments (Stripe): webhook signature checks, whether prices and payment status are checked on the server, and test vs. live key setup.
- Written report: each issue with a severity and a plain-English explanation of the risk.
$469 fixed
What access we need
- Read-only repo access. We don't change your code during the audit.
- Supabase and Stripe settings, only if you grant it yourself. If you want those settings checked, you create a Supabase read-only role or a restricted Stripe key and share that. We never take full keys or logins.
- Without that access, the audit covers the repo only, and the report says so.
SAMPLE OUTLINE
SAMPLE OUTLINE: the structure of the report, not real client data.
What's in your security audit report
- Scope: the repo and commit reviewed, domains, and your access level (repo only, or plus read-only Supabase/Stripe). If it's repo only, the report says so.
- Executive summary: overall risk, findings by severity, the top 3 risks in plain English, and any urgent safety step.
- Scope and method: which checks ran, which didn't and why, and the limits.
- Findings, ranked by severity: each with where it is, business impact, masked evidence, and a high-level fix direction.
- What's already good: controls we confirmed are working.
- Fixed quote to fix what we found: options to fix Critical + High, fix everything, or fix it yourself and have us re-test once.
- Appendices: evidence and checklist coverage across 14 areas.
Reports are confidential and prepared for you only.
What it is, and what it isn't
The audit finds and reports issues within the scope above. It reduces risk. It does not prove your app is secure, and it isn't a penetration test or a compliance certification.
A free public launch-readiness scan is planned; it is not linked here yet.
Part of the Launch Path
A security audit is included in the Launch Path ($1,195 flat), our pre-launch bundle. The bundle price is flat; the audit is not shown as a separate line item there.
If we fix what the audit finds: Fixed, or we keep working free until it is (within the written scope).
Get a $149 diagnosis See pricing Book the $469 audit Or start the Launch Path
- Fixed, or we keep working free until it is (within the written scope).
- A human reviews every fix before it ships.
- read-only access; fixes arrive as pull requests you merge
- Your $149 diagnosis is credited in full toward any paid job.
FAQ
Does a clean report mean my app is secure?
No. It means we didn't find issues in the areas we checked. It can't prove there are none.
Do you need my Supabase or Stripe login?
No. We never take full keys or logins. Grant a Supabase read-only role or a restricted Stripe key if you want those settings checked. Otherwise we audit the repo only and the report says so.
Will you fix what you find?
If you want. Fixes are quoted at a fixed price from the report.
I'm not on Supabase or Stripe. Can I still book?
We check the equivalent parts of your setup where they apply. The report says clearly what was out of scope.