We check what your site already shows to every visitor: exposed API keys, open .env and .git files, source maps, risky CORS and missing security headers.
.env
.git
Read-only. We fetch your public pages and files and never log in or store your secrets. If your app ships a Supabase URL and public key, we use that key to check, with a few read-only requests, whether tables can be read without logging in. We never write or change data. Details.