What does a Supabase security scanner check today?
The hostname your users type into the browser. TLS and certificates, security headers, DNS hygiene, email authentication, cookies, and public exposure signals.
Supabase teams usually worry about RLS and leaked keys first. Fair. But buyers and random scanners still look at your public domain before they ever see your database console. Weak headers and missing DMARC still make you look sloppy in a security review.
RedScore scans from the outside in about 60 seconds. No Supabase credentials required.
What is this not?
Not an RLS audit. Not an API key hunt in your repo. Not a review of your Supabase Auth settings.
If you need database rule testing, that is a different job with different access. This scan answers a simpler question: what does the internet already see on your production domain?
How do I scan a Supabase-backed app?
- Pick your production domain, not the Supabase project URL.
- Go to /lookup and enter that production domain.
- Read the category grades and fix-first summary on the report.
- Close public gaps before launch, payments, or a customer questionnaire.
Do the outside-in pass first. It is free and fast. Then go deeper on backend rules if you still need to.