For Supabase apps built with Lovable, Bolt or Replit Supabase apps · Lovable, Bolt, Replit
See which attacks on your database work, tested on a private copy, and get the fix, in about a minute.
Free · No signup · Nothing leaves your browser
alter table profiles
enable row level security;
create policy "own notes"
on notes for select
using (auth.uid() = user_id);
revoke execute on function
get_all_emails() from anon;22 ways in.
The fix blocks all of them.
| Attack tried | Before | After fix |
|---|---|---|
notesA visitor reads everyone's private notes |
Possible | Blocked |
profilesA user changes their own role to admin |
Possible | Blocked |
get_all_emails()Anyone downloads every user's email |
Possible | Blocked |
profilesnotesget_all_emails() exposes your users tableWhat it catches
These are the mistakes behind the real leaks. Every attack we report was actually tried on a private copy, not guessed from your settings.
Row Level Security off
Your app's public key is visible in your website's code. If a table has no access rules, anyone holding that key can read, change or delete every row.
select * from profilesPossiblealter table profiles enable row level securityBlockedOpen rules
A rule like using (true) lets every user see every other user's rows.
Role columns
If users can edit their own profile, they can often change their own role too.
Billing tables
Users who can write to subscriptions can give themselves the top plan.
Keys in your database
A service_role or API key written into a database function sits in plain text in your database and its backups. We flag those. (This check doesn't see your app's code.)
Back doors
A view or database function can run with full permissions and hand out data your rules protect, like a helper that returns every user's email to anyone who asks.
How it works
You'll need your project's SQL editor: in the Supabase dashboard, or in Lovable under More → Cloud.
Supabase's Security Advisor says no issues? It reviews your settings. Lockstamp actually tries the attacks on a private copy. If any get through, you can hire us to fix them.
Then paste it into your SQL editor and press Run. In Supabase: SQL Editor → New query. On Lovable Cloud: More → Cloud → SQL editor.
Click the single cell under snapshot, copy it (Ctrl+C, or ⌘C on a Mac), and paste it here.
Keep your database setup in code? You can instead
(supabase/migrations/*.sql).
You'll see which of our attacks worked on the private copy, which ones the fix blocks, and (when it can be fixed automatically) a fix file to run.
These parts of your database couldn't be rebuilt in the test copy, so rules that depend on them weren't checked.
Tried on a private test copy with two fake users. Your real database was never touched.
Privacy
The check uses a full Postgres database compiled to WebAssembly, running right here. It rebuilds your tables and access rules from the query result, tries the attacks, and throws the copy away. There's no server to send anything to.
FAQ
Yes. It only reads your database's structure: tables, columns, access rules and functions. It doesn't read any rows, doesn't change anything, and doesn't need a password. You can read every line before you run it.
No. The check runs inside this browser tab. What you paste is never sent to a server, and closing the tab deletes it.
Any app that uses Supabase for its database, including apps built with Lovable (on Lovable Cloud or your own Supabase), Bolt, Replit, v0 and Cursor.
Read it, then run it in the same SQL editor (or add it as a migration). Afterwards, try your app's main features while logged in as a normal user.
It changes who can see what, which is the point: a feature that showed other users' private data will stop doing that. Rules for data that might be meant to be public (like reviews or product listings) are left for you to decide.
Yes. applies the fix to your project, tests your main features, and sends you the before-and-after proof, at an intro price from $150 for the first few clients. You hire and pay through Upwork (opens in a new tab), so your payment is protected. The work runs on an app build system where AI agents write the code, a separate AI reviewer checks every change, and automated tests must pass before anything reaches you.
It doesn't look at your app's code or website for leaked keys, test your live site, or check your login settings or payment flow, and no tool can guarantee an app has no other weaknesses.
Free, about a minute, and nothing leaves your browser.
Run the free check