I read your published code and show where the project contradicts its own access rules
What I look for
Keys that ended up in published code
A database service key, a live Stripe key, a webhook secret in a file that made it into the repository. Such a key bypasses every access rule you have: whoever holds it has more access than any of your own users.
Tables a stranger can write to
An access policy that lets anyone change or delete rows, with no sign-in and no check. Usually the correct policies sit right next to it, which is why the table looks protected.
What I do not do
I read only what you have already published on GitHub. And there will be no overall "your project is fine" verdict: silence where the tool is blind is more honest than a green checkmark.
Who this fits
Your project was built with Lovable, Bolt or a similar builder, the data lives in Supabase, and the repository is public. I run the check by hand and answer myself, so the first ten are free.
The tool is called plumbline. Author: nzt108, hello@nzt108.dev