For Supabase-powered apps
Your app might look secure. But can someone read another user’s data, access private files, or find exposed credentials?
Your live app URL
Free · Read-only security checks · No app data stored
Scanning your app
Your backend details
Open only the ones you care about. Closed ones are skipped.
This is the second door into the same data. The check at the top of this page tests a stranger with no login. This one tests a signed-in user reaching for rows that are not theirs.
Test user A, signs in
No test user yet? This takes about two minutes, and no inbox is needed: create both users in your Supabase, under Authentication, Users, Add user, with Auto Confirm ticked. Made-up emails are fine, like test-a@myapp.com.
How do you want to sign in as A? Pick one.
Not signed in yet. Sign in here, or pick the token option above.
Test user B, never signs in
Create B the same way as A. Then, in Table Editor, add one fake row owned by B in your table and note the number in its id column. That number is all this check needs from B. The check signs in as A and tries to read that one row.
Nothing you type here is sent to MakerGuard, and neither are your results. The tests run in your browser, talking directly to your Supabase and to the homepage you give it.
Runs everything you filled in. Anything left blank is skipped, not an error.
MakerGuard tests your live app for real-world data exposure and gives you evidence-backed findings, not a checklist or a code review.
Fixed something? Run the scan again and watch the verdict change.
Runs from your link alone.
Public data exposureQuick Scan
Can strangers read data without logging in?
File exposureQuick Scan
Can someone retrieve the files your app itself uses, without logging in?
Exposed credentialsQuick Scan
Are privileged keys present in shipped frontend code?
Runs with one test sign-in.
Cross-user accessDeep Scan
Can one user access another user’s records or files?
Settling open answersDeep Scan
The answers Quick Scan left ambiguous, like whether an empty answer means an empty table or a protected one.
Deep Scan tests tables and views through the data API, signed in as a test user. It does not test database functions.
Built for web apps using Supabase, including apps created with Lovable, Bolt, and other AI coding tools.
So far, MakerGuard has examined 61 real AI-built apps.
From the founder
Hi, I’m Swati. I built MakerGuard on my own, and I keep it free, because an app built by one person deserves to be as secure as one built by a team of ten.
Tried it? I’d love to connect personally and hear what worked, what didn’t, or what I should build next.
Optional. Only for our 1:1 chat. Nothing else. Because I hate it too.
Want a nudge to fix this and run the check again in 7 days?
One email, nothing else. Stored separately from the anonymous usage counts, never linked to this check.
What you are probably wondering
The advisor reads your database settings. It never visits your live app, never tries a request as a stranger, and never signs in as one user to reach for another user’s data, which is where the worst leaks live. It also cannot see your shipped website code, where a master key would sit. This performs those tests, on any live app, whichever tool built it.
ChatGPT, Claude and Gemini can only judge what you paste to them. They cannot send the requests, sign in as a second user, or open your files as a stranger. They give opinions. This runs the tests.
Every Issue in your report is a request that actually came back with data, and the evidence is printed in its details. A test that could not be performed is marked Not checked, never guessed, and a name that is not a real table comes back Not checked, not an issue. No answer is given without the attempt behind it.
Swati, a solo founder. Ten years at Microsoft, six of them in data security. She builds MakerGuard in public, and the contact link at the bottom of this page reaches her directly.
Nothing. It is free.
No. The details you type here and the results you see are not sent to MakerGuard and are not stored by MakerGuard. The tests run in your browser, talking directly to your Supabase. If you paste your app link, the link goes to the MakerGuard reader: it reads your app's public code files, sends back what it finds, and stores nothing.
No. Your key and your results are never sent to MakerGuard or stored by it, so there is nothing of yours to train on.
No. There is no AI in the examiner. It runs deterministic checks and reports what came back, so a run today and a run after your fix can be compared like for like.
Questions, or a result you do not believe?