Security scanner for leaky no-code AI apps

What to build

A scanner for apps built on Lovable, Bolt, or base44 that probes the exposed Supabase anon key against the app's tables and reports which ones return data without RLS. Free instant check plus a paid plan for continuous monitoring and one-time security audits, sold to solo builders and agencies shipping AI-generated apps.

17.5% of sampled Supabase-backed AI/no-code apps leak data with no login required, pointing to a scanner-as-a-service niche for RLS misconfigurations.

Demand

Solo builders and agencies shipping Lovable/Bolt/base44 apps want a fast way to check if they accidentally exposed user data, especially since these builders don't enable RLS by default.

• r/nocode (Reddit)Community

  31 of 177 Supabase apps checked (out of ~500 live apps built with Lovable, Bolt and base44) handed back a row with no login, i.e. no RLS enforced

• Original signal reportNews

  Author manually/programmatically tested 177 Supabase-backed apps and found 31 returned unauthenticated data, tying the pattern to AI/no-code scaffolding defaults

Stack

• Supabase JS client / REST API
• Node.js or Python scanner script
• Postgres RLS introspection queries
• Stripe for paid tier billing
• Next.js for the scan dashboard
• Resend or Postmark for monitoring alerts

Solo + AI difficulty

The core check is easy: hit the public Supabase REST endpoint with the anon key and see which tables return rows, which can be scripted in a day. The harder parts are safely/legally scoping what you scan, building a trustworthy report UI, and getting continuous monitoring reliable; a solo builder with AI assistance could ship a usable MVP in about a week.

Entry threshold

Very low barrier: the entire check only requires calling the public Supabase REST endpoint with the anon key already present in the page source, no login or special access needed, so a working scanner can be built in days.

Window

6-12 months

Where to find first users

• r/nocode
• r/Supabase
• Indie Hackers
• Lovable and Bolt Discord/community channels
• Product Hunt launch

Counter-signals & risks

• A 31/177 sample is small and self-selected with undisclosed methodology, so the true leak rate across all Supabase/Lovable/Bolt/base44 apps is uncertain.

• Supabase, Lovable, Bolt, or base44 could close this gap quickly by enabling RLS by default or adding build-time warnings, shrinking the market for a third-party scanner.

• Scanning third-party apps for exposed data without explicit authorization raises legal and ethical concerns that could limit how a free instant-check feature is marketed or operated at scale.