Database check · No login

Your database key is public.
What can it open?

Every Supabase app ships its anon key to the browser. That is by design, as long as row-level security holds. Paste your project URL and that key: we try what a stranger would, table by table, bucket by bucket, and rank the ways in weakest link first.

Counts rows, never reads them · lists at most one file name per bucket · the key is not stored · *.supabase.co only

Project URLPublic key (anon or publishable)The key your site already ships to browsers (Project Settings → API Keys). Never paste the secret / service_role key; if you do, we stop and tell you to roll it.Table names to check (optional)If your schema is private we check the 28 most common table names; add your own here.

Can one user see another’s data? (optional)Create two throwaway users in your app and add one thing as each (a profile, an order). We sign in as each and count whether one can see the other’s rows. Nothing is read or changed; the logins are used for this check only and never stored. Fill both or neither.

Test user A emailTest user A password

Test user B emailTest user B password

This is my project, and I want ShipSafe to test it the way a stranger holding this key would.

This checks the database from the outside. To check the code that talks to it, including your migrations for tables without row-level security, scan your repo. Only check projects you own.

Your database key is public.What can it open?

Your database key is public.
What can it open?