Is your Supabase app leaking?

$ npx airlock-rls --site https://your-app.com

✗ 1 problem(s):
    ✗ https://your-app.com/app.js  Supabase service key exposed in the
      browser — it bypasses ALL Row Level Security. Rotate it now.

RLS audit failed: 1 problem(s) found.  (exit 1)

On a clean site it stays quiet:

$ npx airlock-rls --site https://your-app.com
✓ No problems.  RLS audit passed.  (exit 0)

Why a leaked service key is the worst case

• Your app ships two Supabase keys. The anon key is public by design — that one is fine in the browser.
• The service_role key is the master key. It runs past RLS entirely, so it reads and writes every row of every table.
• Vibe-coded and rushed apps leak it constantly — pasted into a client component, an env var prefixed for the browser, or bundled into the JS. Built with an AI app builder? Run the full checklist for Lovable, Bolt.new or v0.

What the scan does

• Fetches your live page and the JavaScript it loads, and looks for a service_role JWT or a new-format sb_secret_… key.
• Never flags the anon key — it decodes each token and only fires on the real master key. No crying wolf.
• Never prints the key it finds — a security tool must not echo the secret.
• Exits 1 when it finds one, so you can drop it straight into CI.

Open source, and it proves what it claims

Airlock is MIT-licensed and tested. The same engine also runs the full RLS audit — disabled RLS, permissive policies, public storage buckets, and functions that bypass RLS — and can prove a leak by reading your tables with the anon key.