CyberChecker Update: Added deeper Supabase checks

Quick update since my last posts.

CyberChecker has now scanned just over 4,100 sites.

The numbers haven’t improved.

But what has improved is the product.

What’s new

I expanded the Supabase detection logic.

Before, it only flagged obvious exposed anon keys and missing RLS patterns.

Now it:

• Detects Supabase projects more reliably (even when partially obfuscated)
• Checks for signals of permissive or missing RLS policies
• Flags risky public endpoints
• Adds clearer explanations of what “RLS misconfigured” actually means in practice

Supabase is incredibly popular with indie hackers, and it’s also the most common source of silent data exposure I’m seeing.

Updated stats (4,100+ scans)

• 92% have at least one vulnerability
• 63% still expose API keys in client bundles
• 38% show signs of weak or missing RLS protection
• 29% expose config or backup-related files

The Supabase number surprised even me.

What I’m noticing

Security still doesn’t sell by itself.

But when someone sees:

“Your Supabase database could likely be queried without proper row filtering”

They act.

Clarity > fear.

Revenue side

Still $39 one-time.

Still no subscription.

Revenue crossed $3k total.

Conversion rate stable around ~8%.

I’m resisting the urge to turn this into a monitoring SaaS.
Every time I overcomplicated a project in the past, I killed it.