The hook
Supabase is safe when public keys stay public, service-role keys stay server-only, and RLS policies actually fence data. The risky middle is Storage: a bucket can be public on purpose for static assets, or accidentally public for invoices, avatars, profile documents, backups, and exports.
Si funksionon
The scanner extracts Supabase project URLs and anon keys from same-origin JavaScript, then uses the anon client boundary to inspect Storage bucket metadata and object-listing behavior. A public marketing-assets bucket is usually low risk. A bucket with user-data naming, or one that lets anonymous clients list object names, is a stronger signal that authorization belongs in Storage RLS and signed URLs instead of public bucket access.
The blast radius
Anonymous object listing can expose filenames, tenant hints, upload paths, and sometimes the direct object URLs customers assume are private. Even when file contents need a separate request, listing turns a private data lake into an index attackers can scrape.
// what fixvibe checks
What FixVibe checks
FixVibe checks backend-as-a-service exposure through safe configuration and access-boundary signals. Reports focus on what is exposed and how to lock it down. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Keep public buckets limited to static assets. Put user uploads, invoices, profile files, backups, exports, and attachments in private buckets. Gate downloads through authenticated server routes or Storage RLS, issue short-lived signed URLs, and verify anon clients cannot list object metadata unless that listing is intentionally public.