Question 1

How do I check if my Supabase database is exposed?

Accepted Answer

Enter your live app URL into Veridome Surface. It reads the public JavaScript your site already serves, finds your Supabase anon key, and safely checks whether any tables can be read without logging in. You get a result in about 30 seconds with no install.

Question 2

What is Row Level Security (RLS) and why does it matter?

Accepted Answer

The Supabase anon key is meant to be public. Row Level Security is what stops that key from reading or writing every row. AI code generators often ship the key with RLS turned off, which leaves your whole database readable by anyone on the internet.

Question 3

Is the scan safe to run?

Accepted Answer

Yes. The free preview is read-only and count-only, and full scans only run on domains you have verified you own. By default Veridome never writes to your database. There is an optional write test you can turn on per scan, and only on your own verified domains, which writes a single harmless test row and deletes it immediately.