Audit AI
Check my database
Supabase · read-only · nothing to install · free

What can a stranger read in your database?

Paste one read-only query into your Supabase SQL editor and see every table, policy and function that lets someone who is not signed in read or change your data — quoted from your database, with the migration that closes it and the lines that undo it. No repository, no install, no access to your project.

Or scan a public repository. It reads your code as well, and lists what it cannot check as leads, not as holes.

Public repositories, read-only. Free, about 30 seconds, no sign-up, no model call. See an example report.

Want the fix done for you? Fix & re-check, $149.

Anyone can change every row of comments
-- the line your database returned, word for word
policy "Creators can update comments"
  UPDATE · roles: public · USING (true)

-- the migration that closes it
drop policy "Creators can update comments"
  on public.comments;
create policy "Creators can update comments"
  on public.comments for update
  to authenticated
  using (created_by = (select auth.uid()));

Built for what vibe-coding tools actually generate

  • Next.js
  • Supabase
  • TypeScript
  • Lovable
  • Bolt
  • v0
  • Cursor
  • Claude Code
  • Replit

A report anyone on your team can read

Paste a link and get a page that starts with what matters: can one customer reach another customer's data? The developer detail is there too, one click down.

  • A one-line verdict and an honest coverage line, never a score
  • What each problem means for your customers, and what the fix looks like
  • File, path and rule detail one click away, for whoever fixes it
  • What it cannot see listed as leads to check, not as holes

Public repositories only. For a private one, run npx auditai-scan . on your machine.

Example report

example/invoicing-app

1 place may let one customer see another customer's data, and 1 may let a user give themselves access they should not have.

  • CriticalOne customer can read another customer's invoicesReproduced · fix verified
  • HighUsers can change fields they should not, such as their role or teamLikely · not yet proven

Checked 2 risks in class authorization/RLS. Verified fix: 1. Reproduced in the sandbox (fix not verified): 0. Confirmed (no sandbox): 0. Unverified: 0.

How the database check works

Every claim is a line your database returned. No score, no guess.

  1. 1

    Run one query

    A read-only select in your Supabase SQL editor, or npx auditai-scan --snapshot-query. It reads names and rules, never a row of your data.

  2. 2

    Paste the answer

    We read the snapshot and forget it. Nothing you paste is stored, and nothing of ours touches your project.

  3. 3

    See what is open

    Every table, policy and function that lets a stranger, or any signed-in user, read or change data. Each claim is the line your database returned.

  4. 4

    Get the migration

    Where it follows from your schema, the SQL that closes it, the lines that undo it, and a self-check query that changes nothing.

  5. 5

    Apply it yourself

    We never change your database. You read the migration, run it, and paste a new snapshot to see the hole gone.

  6. 6

    Or hand it over

    Fix & re-check: we write the migration for your whole snapshot and check the new one after you apply it. $149, database only.

What we do not promise

No tool can prove your app has zero vulnerabilities, and we will not pretend otherwise. Every result reports its coverage in one honest line:

Checked 12 risks in class authorization/RLS. Verified: 2. Confirmed (no sandbox): 1. Unverified: 0.

Version 0 goes deep on one class instead of wide on ten: broken object-level authorization, tenant isolation, Supabase RLS and service-role misuse. That is where AI-generated SaaS apps leak.

Three ways to run it

CLI, open source

Deterministic scan in seconds, no account, no model. Source, rules and fixtures on GitHub.

npx auditai-scan .
# findings, coverage, exit code for CI

Database check from the terminal

Print the read-only query, run it in your SQL editor, and check the result on your own machine. Nothing is sent anywhere.

npx auditai-scan --snapshot-query
# run it, save the result, then:
npx auditai-scan --snapshot snapshot.json

MCP for Claude Code and Cursor

Your coding agent calls audit_scan, audit_get_context and audit_propose_fix, and your own model decides what is real. No API key, no account, no shell tool. Setup guide.

claude mcp add auditai -- npx -y auditai-mcp
> "scan this repo and check what Audit AI finds"

Pricing

Free

$0

  • Stranger Check: paste one query, see what is open
  • The migration that closes it, and the lines that undo it
  • Repository scan and MCP server for Claude Code and Cursor
  • Nothing you paste is stored
Check my database

Fix & re-check

$149/one time

  • We read your snapshot and write one migration for everything open, with its undo lines
  • You apply it; we check the new snapshot and tell you what is still open
  • Database only: invoice within one working day, migration within two of payment
  • Full refund if our migration, applied as written, leaves the hole open
  • Done by us and invoiced by email, paid in crypto
Get it fixed

Night watch

$49/project/year

  • About once a day we check again what your database lets a stranger do
  • An email when something new is open, with the line your database returned and the fix
  • Through a role that is granted nothing and cannot read or change your tables
  • Needs a Supabase project you own
Start the night watch

The check itself is free and always will be. You pay for work done for you, or for watching: your app keeps changing, and a table added on Tuesday can be open by Wednesday. Payment is in USDT or through CryptoBot for now.

Want one repository checked by a person now? Verified audit, $299 one time →

Questions

Use it: it is free and it flags the same five classes we lead with. We add three things. We quote the line your database returned and tell you who can actually use it. We report a SECURITY DEFINER function only when it does not check the caller, where the Advisor flags every one anon can run. And we list tables anyone can read, which the Advisor skips on purpose, with the question "is that meant to be public?". Where it follows from your schema, each finding comes with the migration that closes it.

Open to everyone, today

No slots and no waitlist. Check your database, scan a public repository, or run the open-source scanner with npx auditai-scan. For a private repository, a question, or an investor conversation, leave your email or write to hello@auditai.sh.