The request names Supabase, so Supabase 1 comes first: a Postgres development platform with Auth, instant APIs, Realtime, Functions and Storage, reachable through its JavaScript SDK, CLI and an agent skill. For security testing of a Supabase project, the audit tools below check Row Level Security, exposed keys and open Supabase backends, while sqlmap 6 and Semgrep 7 test the application code in general.
- 1
Supabasesupabase.comverified and signed
Postgres development platform whose official doors include the @supabase/auth-js SDK, the Supabase CLI and a supabase-postgres-best-practices skill, used to build and manage the backend being tested 1.
official:SDK · @supabase/auth-jslibrary · Supabase CLI ActionCLI · supabasepackage · Supabaserepository · supabase+106 community tools built for it
for agents: supabase · supabase/setup-cli · supabase
- 2
ShipLatchshiplatch.comwebsite read, tools not yet checked
Security scanner for apps built with Lovable, Bolt, Replit, Cursor and v0 that finds leaked keys, exposed .env files and open Supabase backends, and offers an MCP server 3.
official:MCP server · ShipLatch
- 3
VibeRavenviberaven.devwebsite read, tools not yet checked
Local check run with npx that audits AI-built Vercel and Supabase apps for missing RLS on tables, exposed keys, env vars and Stripe webhook issues 4.
- 4
- 5
Sources
- 1Supabase | The Postgres Development Platformsupabase.com · read 2026-10-29
- 2Free Security Audit for AI-Built Apps | Snapforge Labsnapforgelab.com · read 2026-10-29
- 3ShipLatch: Fix it and prove it. Security for vibe-coded appsshiplatch.com · read 2026-10-29
- 4VibeRaven | From demo to production for AI-built appsviberaven.dev · read 2026-10-29
- 6sqlmap — automatic SQL injection and database takeover toolsqlmap.org · read 2026-10-29
- 7Semgrep App Security Platform | AI-assisted SAST, SCA and Secrets Detectionsemgrep.dev · read 2026-10-29
For agents: the 10 actions behind this answer
supabase · @supabase/supabase-js verified and signed
· Snapforge Lab website read, tools not yet checked
Is your Replit, Lovable or Bolt app leaking user data? Free read-only security audit in 24h: Supabase RLS, exposed secrets, CORS, Stripe webhooks.
· ShipLatch website read, tools not yet checked
Free security scan for apps built with Lovable, Bolt, Replit, Cursor and v0. Find leaked keys, exposed .env files and open Supabase backends. Fix Pack adds copy-paste fix prompts and re-scans that prove the fix.
· VibeRaven website read, tools not yet checked
Run npx -y viberaven before launch: check AI-built Vercel + Supabase apps for RLS, keys, env vars and Stripe webhooks. It runs locally. Advice, not a gate.
· Supbuddy docs website read, tools not yet checked
Getting started, features, MCP setup, the CLI and daemon, troubleshooting, FAQ, and reference for Supbuddy. Run multiple Supabase projects at once with custom local domains, via the macOS app or the CLI (macOS and Linux).
· sqlmap website read, tools not yet checked
sqlmap is an open-source penetration testing tool that automates detecting and exploiting SQL injection flaws and taking over the databases behind them. Dual-licensed under GPLv2 and a commercial license.
semgrep · semgrep verified and signed
Semgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.
ship_safe_audit · ship-safe verified and signed
Run a Ship Safe security audit on a local codebase directory.
· TurboPentest website read, tools not yet checked
Self-service agentic AI pentest. Buy online and get your pentest report in hours. 14 tools plus AI agents find vulnerabilities and tell you what to fix. $99.
vulnerabilities · safety verified and signed
Labels are the instruments' verdict and are never changed by ranking. Agents and robots get this same answer as JSON at /api/v1/find?q=…&answer=1 and through the MCP server.