App Security Scanner

Scan the app in the current tab for exposed keys, open database tables and broken row-level security.

App Security Scanner reads the JavaScript your app already serves the public and checks for exposed API keys, open database tables, missing security headers and signs of broken authentication. This extension runs the same free scan from your toolbar: open the app you shipped, click App Security Scanner, and see your grade and findings without leaving the tab. The scan reads what a visitor's browser already sees and inspects your app's public Supabase REST endpoints. It does not ask for your source code, database password or admin credentials. The full report on thecompound.tech/tools/app-security-scanner adds a cross-tenant test: two disposable accounts sign up through your app and check whether one can read the other's rows, table by table. A Compound Labs product.