The complete external security scan, done the moment you pay.
The attacker’s-eye view, done completely: every common table probed (not just the first), anonymous write attempts, storage buckets, auth endpoints, security headers and exposed config. You get the full written report with the exact fix for each finding, straight away. No call. No human in the loop.
This is the complete external view: everything reachable from outside without your credentials. It is not a clean bill of health. A real attacker with an account, or a look at your code, can expose things only the inside review (the $299 Ship Check) catches.
Free preview vs $47 complete vs $299 with-access
The $47 is the whole external battery. The inside view, your per-table policies, secrets and access rules reviewed by a senior engineer, is the $299 Ship Check, and your $47 comes off it for 24 hours after this report.
| Check | Free preview | $47 complete | $299 with-access |
|---|---|---|---|
| Reachable + valid SSL | yes | yes | yes |
| Live API keys exposed in page / JS bundle | headline RED patterns | full pattern set | yes + server-side secret audit |
| Supabase project + anon key detected | yes | yes | yes |
| Anonymous table READ (RLS gap) | first table, spot-check | every probed table | every table + RLS policy review |
| Anonymous table WRITE / insert | no | yes (safe no-op probe) | yes + per-policy review |
| Storage bucket exposure | no | yes | yes + bucket policy review |
| Auth endpoint config | no | yes (external probes) | yes + full auth config review |
| Security headers (HSTS, CSP, X-Frame, nosniff, Referrer-Policy) | no | all five | yes |
| Exposed config / paths (.env, /.git, source maps) | no | yes | yes |
| Per-table RLS policy correctness | no (not visible from outside) | no (not visible from outside) | yes (the point of this tier) |
| Written report + exact fixes | one-line verdict | full report + fixes | full report, human-ranked |
| Human review | no | no | yes (senior engineer) |
| Delivery | instant | instant, automated | within 48h of access |