I built this after finding a service_role key in the client bundle of one of my own side projects. It had been live for weeks. That key bypasses RLS completely, so anyone who opened the site could have read every row of every table.

Four checks: tables in public without RLS (or with using(true) policies), secrets in repo files and the live bundle, route handlers that take a caller-supplied id with no auth check, and storage buckets marked public. It reads migrations and route handlers in the repo, because a URL scanner can't see any of that.

All four rules are written out in full on the page. I also publish precision/recall against my test corpus at /precision: 9 repos, 24 planted findings. Small corpus, and I built it myself, so take the numbers for what they are. There's a full unedited sample report at /sample.

Scanning is free and needs no login. Happy to answer anything, especially about false positives.