Is the Supabase anon key a secret?

No. It is meant to be in your app, and row level security decides what it can read. The service role key is the secret one. It must never reach the browser.

Will a fix break my app?

You choose how fixes ship. With pull requests, you review every change before it merges, and every fix is tested again with the original attack.

How often should my app be tested?

If you ship new features every day, daily checks test each day's changes. Monthly checks fit an app that changes less often.

AGENTPROOF TESTS
AND FIXES
APPS BUILT WITH AI.

AI coding tools can build a working app in a day. They can also leave the database open or a secret key in the browser. AgentProof finds these problems in your app and fixes them in your code.

Apps from Lovable, Bolt, Cursor or Replit are checked for open data.

SUPABASE: Is row level security on for every table, so your public key cannot read every row?
FIREBASE: Do your security rules let anyone read or write the whole database?
SECRET KEYS: Is a Stripe secret key, model provider key or Supabase service role key in the code sent to the browser?
HIDDEN PAGES: Are admin pages only hidden from the menu, but still open to anyone who types the address?
SERVER CHECKS: Does the server check who the user is, or does only the browser check?
SIGN UP: Can anyone sign up and get access that should be invite-only?

The public key in your app is meant to be public. Your database rules are what keep the data private.

An example: a Supabase table with row level security turned off.

EXAMPLE FINDINGAnyone with the public key can read every user's profile

REQUEST

GET /rest/v1/profiles?select=*
Public key, not signed in

RESPONSE

200 OK
Every user's email and phone number

FIX

+ alter table profiles enable row level security;
+ create policy "Read own profile" on profiles
+   for select using (auth.uid() = id);

RETEST

GET /rest/v1/profiles?select=*
200 OK, 0 rows. Fixed.

The fix is a database migration in your repository. After it, each user can read only their own profile.

The Attack Agent tests your live app, not just the code it came from.

READING THE CODE

Misses rules set in your database dashboard
Guesses what the live app does

AGENTPROOF

Sends requests to your live app and records what it actually sends back.

Answers for founders who build with AI coding tools.

IS THE SUPABASE ANON KEY A SECRET?: No. It is meant to be in your app, and row level security decides what it can read. The service role key is the secret one. It must never reach the browser.
WILL A FIX BREAK MY APP?: You choose how fixes ship. With pull requests, you review every change before it merges, and every fix is tested again with the original attack.
HOW OFTEN SHOULD MY APP BE TESTED?: If you ship new features every day, daily checks test each day's changes. Monthly checks fit an app that changes less often.

Monthly checks for one app cost $199 a month.

Both agents are included. Weekly checks cost $399 and daily checks cost $999 a month.

See plans See how fixes work

AgentProof also tests these kinds of apps.

AgentProof is in development. The example finding on this page is an illustration, not a result from a customer's app.