Most scanners check that your database rules exist.
DeployWarden checks they actually work.
A security Deep Check that proves your vibe-coded app enforces the right access rules — not just that a policy file is present. Start with a free passive scan.
The problem
“RLS exists” ≠ “RLS works”
Platform “Security” views and most scanners confirm that a Row Level Security policy is present. They don’t log in as two different users and try to read each other’s data. Public research on CVE-2025-48757 found that of 1,645 Lovable projects scanned, about 10% had inadequate Supabase RLS across hundreds of endpoints.
Our wedge
Behavioral, ownership-gated tests
After you prove you own the app, we run real cross-user read/write attempts, anonymous-write attempts, storage probes, and key-leak checks — then hand you a plain-English report with fixes you can paste straight back into Lovable, Bolt, or Cursor.
How it works
Run the free scan
Paste your app URL. We passively check the public surface and give you a severity score in seconds.
Verify you own it
Add a DNS TXT record or drop a token file at /.well-known/deploywarden.txt. Active tests never run without this.
Get the Deep Check
We use your anon key and two test accounts to actually try to break your RLS — then send a plain-English report with copy-paste fixes.
Free passive scan
Read-only, no ownership proof required. Great first look.
Leaked secrets in your JS
We scan your page and JavaScript bundles for the Supabase service_role key, Stripe secret keys, OpenAI keys, and other credentials that should never reach the browser.
Security headers & TLS
HSTS, Content-Security-Policy, and the other headers that protect your users — plus a check that you're actually serving over HTTPS.
Exposed .env, .git & source maps
Common leak paths like /.env and /.git/HEAD, and public source maps that hand attackers your original code.
Supabase fingerprint
We detect your Supabase project and anon key so you know exactly what the Deep Check will test next.
Paid Deep Check — $39
Active tests after ownership verification and your consent. One free rescan included.
- Can user A read user B's rows? (cross-user RLS)
- Can user A modify or delete user B's data?
- Can an anonymous visitor write with just the anon key?
- Are any storage buckets public that shouldn't be?
- Is the service_role key leaked anywhere in client code?
- Does the app trust the client for payment status?
Ship it knowing it’s locked down.
Run the free scan now. If it finds something, the Deep Check proves exactly how bad it is — and gives you the prompt to fix it.