# RLS Radar

> RLS Radar is a free web tool that checks a vibe-coded web app you own. On any public site it looks for leaked secret API keys (OpenAI, Anthropic, Stripe live secret/restricted, GitHub, AWS, Slack) in the page and same-origin JavaScript, exposed .env/.git/config files (content-signature match only), missing security headers and public source maps. If it finds Supabase it flags service_role / sb_secret_ keys and runs defensive, read-only Row Level Security (RLS) signals; if it finds Firebase it checks, read-only, whether Realtime Database, Firestore and Storage answer without sign-in. It requires the user to confirm they own the app or have permission, never downloads row/document/file contents, never writes, and stores no scan results.

Key facts (verified against Supabase docs, 2026-10-16):
- A Supabase anon or sb_publishable_ key in frontend code is expected and safe by design; it only reaches what grants + RLS allow.
- A service_role or sb_secret_ key in frontend code is a leak: those keys bypass RLS. Rotate them.
- A table in an exposed schema without RLS is readable and writable by any role with a grant on it.
- Never base RLS authorization on user_metadata (raw_user_meta_data): signed-in users can change it. app_metadata cannot be changed by the user (Supabase RLS docs, verified 2026-10-19).
- A Firebase web config (including apiKey) is public by design per Firebase docs; data is protected by Firebase Security Rules and App Check (verified 2026-10-18).

## Tool
- [Methodology](https://rlsradar.vercel.app/#methodology): what is checked (public HTML/JS, key classification, limit=0 counts) and what is never done (no row data, no writes, nothing stored).
- [Free scan](https://rlsradar.vercel.app/): paste your app URL, tick the permission box, get findings plus an AI fix prompt.

## Guides
- [Supabase Storage bucket policies: public vs private, per-user folder RLS, signed URLs](https://rlsradar.vercel.app/guides/supabase-storage-bucket-public-vs-private.html)
- [Supabase RLS policies for multi-tenant apps: org membership, auth.uid() patterns, security definer helpers, app_metadata vs user_metadata](https://rlsradar.vercel.app/guides/supabase-rls-multi-tenant-auth-uid.html)
- [Supabase Oct 30, 2026 Data API change: new public tables need explicit GRANTs; RLS unchanged](https://rlsradar.vercel.app/guides/supabase-data-api-change-oct-30-2026.html)
- [Supabase RLS checklist](https://rlsradar.vercel.app/guides/supabase-rls-checklist.html)
- [Supabase anon key exposed: what it means](https://rlsradar.vercel.app/guides/supabase-anon-key-exposed.html)
- [How to check if Supabase RLS is enabled](https://rlsradar.vercel.app/guides/check-supabase-rls-enabled.html)
- [Leaked service_role / secret key: rotation steps](https://rlsradar.vercel.app/guides/supabase-service-role-key-leaked.html)
- [Before you ship an AI / vibe-coded app](https://rlsradar.vercel.app/guides/before-you-ship-ai-app.html)

## Optional