Sentrint

Row-level security is off
Your Supabase anon key is public by design. RLS is the only thing stopping anyone from reading every row. Check: Table Editor, look for the "RLS disabled" badge. Any table with user data and that badge is a public database.

RLS is on but the policy allows everything
using (true) is the same as no policy. Check: Authentication > Policies. If a policy never references auth.uid(), it is not restricting anything.

Secrets in NEXTPUBLIC or VITE_ variables
Those get compiled into the JS bundle and shipped to every visitor. Service role keys land here constantly because the AI put them there to clear an error. Check: grep -rn "NEXT_PUBLIC_\|VITE_" .env*. Would you print each value on your homepage? If not, move it.

Auth that only runs in the browser
A redirect in a React component is a suggestion, not authentication. Check: curl your most sensitive API route with no session cookie. If it returns data, your auth is in the wrong place.

.env in git history
Deleting the file does not remove it. If the repo was ever public, assume the keys are gone. Check: git log --all --full-history -- .env. Any output means rotate today.

Webhook with no signature check
Anyone who finds the URL can POST a fake "payment succeeded" and upgrade themselves free. Check: your Stripe or Paddle handler. If it reads the body before verifying a signature, it is an open door.

Sentrint scans the repository behind your AI-built app to surface exploitable security risks and guide you to a fix. We are trying to make security easy for non-tech founders.

Which of these did you find on your own app?