Questions · BreachProbe

Question 1

Is LaunchGuard free?

Accepted Answer

There is a free tier and it is not a findings paywall — LaunchGuard's pricing page states "Free $0 forever" and "It is not a paywall on findings." The free scan includes all three engines, logged-in tests, and the receipt for every finding. Pro is $29/month and adds the parts a one-off scan cannot do: it re-checks on every deploy automatically, keeps unlimited saved guards where free keeps two, and remembers every result.

Question 2

What does BreachProbe cost?

Accepted Answer

The scan is free, with no account and nothing to install — you paste a URL. A full report is $19 as a one-off payment, covering where every finding is, the cross-tenant result table by table, and a written fix per issue. $39 buys the same report plus a nightly re-scan for 30 days and an email the moment a new critical or high issue appears.

Question 3

Do either of them test whether one user can read another user's data?

Accepted Answer

Yes, and it is the single most important row in the table. BreachProbe signs up two accounts and reports a cross-tenant result table by table. LaunchGuard covers it as a saved "guard" — its free tier keeps up to two, named on its pricing page as "a cross-user leak, a payment bypass, or any rule you name". A scanner that only looks at what an anonymous stranger can reach cannot tell a working RLS policy from a broken one, because both of them refuse the stranger.

Question 4

Do I still need one of these if Supabase has a Security Advisor?

Accepted Answer

They answer different questions, so running the Security Advisor first is right and running only it is not. The advisor reads your project's configuration from inside the dashboard and runs automatically — its published checks include "auth users exposed" and unindexed foreign keys. It does not sign in to your shipped app as two different users and try to read one's rows with the other's session. That is what an external scanner does, and it is the check that catches a policy which is present, enabled, and wrong.

Question 5

What is the best free Supabase security scanner?

Accepted Answer

Four of the five here are free to run. The Supabase Security Advisor costs nothing and is already inside your dashboard, but it inspects your project's configuration rather than your shipped app. SecurifyAI's RLS scanner is open source and free to use, and can be run locally or as a Firefox or Chrome extension. Suparbase's Security Scanner is free with “no sign-up, no email wall, and no trial timer”, and shows “which of your tables an anonymous visitor can read right now”. BreachProbe's scan is free with no account and nothing installed. LaunchGuard also has a free tier that its pricing page states is not a findings paywall.

Question 6

Which of these actually tests row-level security?

Accepted Answer

Only the ones that sign in. BreachProbe signs up two accounts and reports cross-tenant results table by table. LaunchGuard signs in as a real user and lets you save a cross-user leak as a guard it can re-run. Suparbase gets closest of the rest: its scanner is explicitly the anonymous view, but its admin can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims. All rolled back.”, which answers the question one query at a time rather than reporting it. The Supabase Security Advisor and SecurifyAI's scanner do not publish a test of one authenticated user reading another's rows on the pages cited here. That distinction matters more than price: a policy that is enabled but wrong looks identical to a correct one from the outside, because both of them refuse an anonymous request.

Question 7

Do I need to give a scanner access to my Supabase project?

Accepted Answer

Two of these ask for it. The Supabase Security Advisor runs inside the dashboard, so it needs dashboard access by construction. Suparbase asks you to “Paste a Supabase URL + API key”, which it encrypts at rest and proxies server-side so the key never reaches the browser — though its free Security Scanner needs no account. BreachProbe needs one URL and states “No account · nothing installed · read-only”. LaunchGuard scans from a URL, with sign-up (free, no card) required to see the full detail of a leaked key. SecurifyAI's scanner runs on your own machine or in your own browser, which is why it is the one to reach for when the app cannot be exposed to a third party at all.

Question 8

How often should a vibe-coded app be re-scanned?

Accepted Answer

Every time you ship, because the failure mode is a new table or a changed policy rather than a new vulnerability in old code. Three of these automate it: LaunchGuard's Pro tier re-checks on every deploy automatically, Suparbase's Hosted tier runs “Agent Sentry continuous scans” as a continuous anon-key probe, and BreachProbe's $39 tier re-scans nightly for 30 days and emails on a new critical or high finding. The Supabase Security Advisor runs automatically inside the dashboard but only sees configuration. A scan you have to remember to run is a scan that stops happening in week three.

Question 9

What is the difference between a configuration check and an external scan?

Accepted Answer

A configuration check reads your project's own settings — the Supabase Security Advisor's published checks include "auth users exposed" and unindexed foreign keys, and it runs automatically inside the dashboard. An external scan reads what your app actually serves to the internet: the keys left in the shipped JavaScript bundle, the tables that answer with no login, and what a signed-in user can reach. They overlap very little, which is why running one is not running the other.

Question 10

Why does the two-user test matter more than the anonymous one?

Accepted Answer

Because an anonymous request is refused by a correct policy and by a broken one alike. Row-level security that is enabled but does not isolate users — a policy that checks a column that is always true, or one missing a with-check clause on insert — looks perfect from the outside and hands every customer's rows to any account that signs up. The only test that separates those two states is signing in as two different users and trying to read one's data with the other's session. BreachProbe and LaunchGuard both do it. Suparbase can reach the answer through its RLS debugger, which will “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims”, but that is a query you write rather than a result it reports, and its scanner proper is the stranger's view. The other two do not publish that they test it at all.

Question 11

Are free security scanners good enough for a launched app?

Accepted Answer

For finding the obvious catastrophe, yes. Four of the five here are free to run and all of them will find a table serving rows to the public or a service key left in the bundle. What money buys in this category is not better findings but continuity: LaunchGuard's $29/month re-checks on every deploy and remembers the results, Suparbase's “$12 per user / month” Hosted tier runs a continuous anon-key probe, and BreachProbe's $39 tier re-scans nightly for 30 days. The risk of a free scan is not that it misses things on the day — it is that it happens once.

Question 12

Can I run any of these against an app I have not deployed publicly?

Accepted Answer

One. SecurifyAI's RLS scanner is open source and can be run locally or installed as a Firefox or Chrome extension, so it can be pointed at an environment that is not reachable from the internet. The Supabase Security Advisor works on the project regardless of whether the app is public, because it reads configuration rather than traffic, and Suparbase's admin connects to the project directly with a URL and key rather than to the shipped site — but its Security Scanner, like LaunchGuard and BreachProbe, works from something a stranger could reach. That is also exactly the thing those three are testing.

Question 13

Does Suparbase test whether one user can read another user's rows?

Accepted Answer

Not as a signed-in probe, and this is the difference that matters. Suparbase's free Security Scanner reports “which of your tables an anonymous visitor can read right now” — the stranger's view. Its admin includes an RLS debugger that can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims. All rolled back.”, so you can construct the two-user question one query at a time against your own connection. BreachProbe signs up two real accounts against the shipped app and reports the cross-tenant result table by table without you writing anything. Both are useful; only the second one answers the question by default.

Question 14

Why does an anonymous scan miss the worst Supabase leak?

Accepted Answer

Because a broken policy and a correct one look identical to a stranger. Row-level security that is enabled but does not isolate users — a policy checking a column that is always true, or one missing a with-check clause on insert — refuses an anonymous request exactly the way a correct policy does. The leak only appears once a request carries a valid session, because that is when the policy is actually evaluated against a user id. A scan that never signs in therefore returns a clean result on the single most expensive misconfiguration in this category.

Question 15

What does Suparbase cost?

Accepted Answer

Its pricing page states “Free $0 forever” for an individual — “Up to 3 Supabase connections”, a solo workspace, an AES-256-GCM credential vault and 30-day audit log retention, with “No credit card. No time limit.” Hosted is “$12 per user / month” and adds unlimited connections, a team workspace, 90-day retention and “Agent Sentry continuous scans”. A Team tier with SSO and single-tenant deployment is quoted on request. Separately, five tools — the Security Scanner, RLS generator, schema visualiser, type generator and secret scanner — are free with “no sign-up, no email wall, and no trial timer.”

Question 16

What does BreachProbe cost, and do I need an account?

Accepted Answer

No account, and the scan is free — you paste a URL, nothing is installed, and the read is read-only. A full report is $19 as a one-off payment: where every finding is, the cross-tenant result table by table, and a written fix per issue. $39 buys that same report plus a nightly re-scan for 30 days and an email the moment a new critical or high finding appears. There is no per-seat charge and no subscription on the $19 tier.

Question 17

Can I use both?

Accepted Answer

Yes, and it is the cheapest sensible setup. Suparbase's free tier and its five no-account tools cost nothing, and BreachProbe's scan costs nothing, so running both today is free. They overlap very little: Suparbase watches the project you operate — continuously, on the paid tier, via an anon-key probe — while BreachProbe answers what a second signed-up user can reach on the app you shipped. Neither is a substitute for the other, and the failure they respectively catch is different.