Rowly

Features

Everything a stranger could try

You shipped it fast. Rowly checks what strangers can actually reach - and hands you the fix. No database password, no security background needed.

Built for people who ship with AI tools, not security engineers. Supabase or Firebase, Vercel, Netlify or AWS, built in Lovable, Base44, Bolt or Replit - Rowly checks all of it, explains each issue in plain English, and gives you a copy-paste fix for the same AI tool you built with.

Run a free audit
58/ 100

Security Health Score

Score out of 100 based on total findings. Lower means more issues detected across tables, functions, roles, and database config.

Elevated risk detected. Review critical findings and apply hardening SQL.

24 CHECKS · 4 CRITICAL · 9 WARNING · 11 SECURE

Critical Warning Secure

Tables Scanned

18

Secure Tables

11

of 18 with no issues

Warnings

9

5 tables · includes functions & config

Critical Findings

4

0 RLS off · check functions & roles below

Total Findings

13

warnings + critical across all layers

Why Rowly

Nothing else looks at all of it

A Supabase dashboard tool only sees Supabase. A generic scanner never touches your live app. A real penetration test costs more than most side projects earn in a year. Rowly checks your whole stack from the outside, in minutes, for about the price of lunch.

6/6Rowly
0/6Supabase Security Advisor
0/6Generic SAST scanners

Scans from a public domain alone

No database password or service_role key. Rowly discovers your Supabase project from public HTML/JS the same way a browser would.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Proves anonymous data exposure

Live anon-key probes: table SELECT, OpenAPI write grants, canary INSERT/DELETE of scanner-owned rows, and GraphQL when REST is locked down.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Checks beyond the database

Storage buckets, signup/auth posture, Realtime, and the hosting platforms and AI builders vibe-coded apps actually ship on - Vercel, Netlify, AWS, Firebase, Lovable, Base44, and more - not just table RLS toggles.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Catches leaked secrets in client code

Flags service_role / sb_secret keys, sourcemaps, .env, and .git when they are reachable from the outside.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Honest about what it cannot see

RLS policy SQL, function bodies, triggers, and authenticated-only policies stay listed as gaps - never silently marked clean.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Ready-to-paste AI fix prompts

Every finding includes plain-English risk plus a ready-to-paste prompt for your AI coding tool - no SQL console, no dashboard steps.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

External attack surface

It tries things. It doesn’t just tick boxes.

Rowly finds every service behind your domain - your database, your hosting, even the AI builder you shipped with - and actually tests them the way a real attacker would. Look-but-don’t-touch checks run on every plan. The deeper tests, which write a throwaway test row and delete it straight after (never your real data), run on a paid plan once you’ve proved you own the domain.

Run free audit
  • Database reads
  • Canary writes
  • Auth posture
  • Vercel, AWS & more

External attack surface

5 findings · sorted by risk

  • Rowly read real rows out of "invoices" without signing in, using only the public key. This is exactly what an attacker with no account and no password would see.

  • Rowly created a test row in "profiles" without signing in, and it worked - a confirmed, working exploit anyone on the internet can use right now.

  • Rowly found your project's service_role (secret) key inside the HTML/JavaScript your website sends to every visitor's browser. This key ignores every access rule you've set up - anyone who copies it has full, unrestricted access to your entire database.

  • Your "receipts" storage bucket is marked public. Anyone can download any file in it without signing in - a real problem for a bucket named "receipts."

  • This project's auth settings show new sign-ups are logged in immediately, without clicking a confirmation link first. Anyone can create an account using an email address that isn't theirs.

Fixes included

You don’t need to understand it to fix it

Every issue is written in plain English - what it is, what could actually go wrong - and comes with a button that copies a ready-made fix for Lovable, Bolt, Cursor, Replit, v0, or whatever you built with. Paste it in and your AI tool does the work. There’s no SQL console to open, and a single ‘fix everything here’ prompt for each group of issues.

Run free audit
  • Plain English
  • AI-ready prompt
  • Fix-all prompt
  • Severity ranked

Every finding ships with the fix

Findings are ranked by severity and confidence, and each one carries a ready-to-paste prompt for your AI coding tool - no SQL to run yourself.

  • Rowly read real rows out of "invoices" without signing in, using only the public key. This is exactly what an attacker with no account and no password would see.

AI fix prompt

I'm using Rowly, an external security scanner, and it found this issue:

**Anyone can read data from the "invoices" table without signing in**
Rowly read real rows out of "invoices" without signing in, using only the public key. This is exactly what an attacker with no account and no password would see.

Where this was found: https://xyzcompany.supabase.co/rest/v1/invoices?select=*&limit=1 - HTTP 200 with row data

Here's a suggested fix (adapt table/column/policy names to match my actual schema if they differ):

```sql
-- Restrict who can read public."invoices"
-- Dashboard: Table Editor → invoices → Policies → remove/tighten the public read policy
ALTER TABLE public."invoices" ENABLE ROW LEVEL SECURITY;
REVOKE SELECT ON public.invoices FROM anon;
```

Please fix this directly in my project. If you need to see specific files first, ask me for them.

Fix row level security

5 findings · Combined AI fix prompt

Domain verification

Two testing tiers, by design

Sign up free and Rowly will look at any domain the way an ordinary visitor's browser would. The deeper tests - the ones that write data, create a test account, or call your functions - only run once you've proved you actually control that domain, on a paid plan.

Every plan, no setup

Look, don't touch

Runs the moment you type a domain in. Nothing here writes data, creates accounts, or calls your functions - it's everything an outside visitor's browser can already see.

  • Data anyone can read from your database without logging in
  • Passwords and API keys left in your public website code
  • Your .env file or .git folder being downloadable
  • Missing browser protections that stop attacks on your visitors
  • Forgotten staging and admin subdomains, found in public certificate records
  • How your signup and login are configured

Paid plan + verified domain

Actually try to break in

Once you're on a paid plan and your domain is verified, Rowly stops guessing and proves it: it writes a throwaway test row, creates a test account, and calls your server-side functions to see what a stranger could really do. Everything it creates is deleted immediately - your real data is never touched.

  • Can a stranger add, edit, or delete rows in your database? Rowly tries it
  • Can anyone upload files to your app - or replace the ones already there?
  • Can someone sign up with an email address that isn't theirs?
  • Once someone has any account, can they reach everyone else's data?
  • Can your server-side functions be triggered by anyone who finds them?

Verifying takes one DNS record

Add a TXT record at _rowly-verify.yourdomain.com with the token Rowly gives you, then click "check now". Same model as Google Search Console or Vercel domain verification - we never ask for a database password or admin access, only proof you control DNS.

No password, ever

Verification proves you own the domain; your plan decides which checks run. Neither one hands Rowly a password - and active testing only ever runs against a domain you've verified, never one someone else submitted.

Coverage

One scan, your whole stack

Rowly works out which platforms are behind your domain on its own and runs the right checks for each - including independent grades from Mozilla Observatory, Qualys SSL Labs, and Shodan, plus certificate-transparency history from crt.sh and Cert Spotter, so you're not just taking our word for it.

Backend

  • Supabase
  • Firebase
  • Clerk
  • Convex
  • Appwrite

Hosting

  • Vercel
  • Netlify
  • AWS S3 / CloudFront
  • GitHub Pages
  • Cloudflare

AI app builders

  • Lovable
  • Base44
  • Bolt.new
  • Replit

Independent security scanners

  • Mozilla HTTP Observatory
  • Qualys SSL Labs
  • Google Safe Browsing
  • Certificate Transparency (crt.sh + Cert Spotter)
  • Shodan (exposed database & admin ports)
  • Domain expiration (RDAP)

Risk & exposure

  • Known CVEs in your JS libraries
  • Lookalike / phishing domains

Web security basics

  • HTTP headers
  • TLS / HTTPS
  • DNS
  • Leaked secrets & .env/.git
  • CORS
  • Subdomain takeover

marks checks unlocked on Pro and Pro+ - Free stays on Supabase and the web-security basics.

Unlock every check with Pro

Features

Built to catch it before your users do

Alerts only on what's new

Rowly re-scans on a schedule and diffs against the last run, so you're pinged when a new vulnerability appears, not by the same noise every day.

Prioritized by data sensitivity

Findings are ranked by what's actually at risk, from emails and tokens to cards and passwords, so you fix what matters first.

Shareable audit reports

Export a full PDF report with every finding and its AI fix prompt, ready to hand to a client, a teammate, or a security reviewer.

Pricing

Free to look. Cheap to keep watching.

Compare all plans

Free

$0

See what strangers can reach today. Free forever, no card.

  • Find out in 60 seconds whether strangers can read your users' data
  • Leaked API keys and passwords spotted in your public code
  • Exposed .env and .git files anyone could download today
  • Security headers, HTTPS and DNS checked and explained in plain English
  • A copy-paste fix for every issue, written for your AI coding tool
  • 1 project, rescan any time
Start free

Pro

…/mo

billed monthly

Stop checking manually. Rowly watches your whole stack and tells you the moment something breaks.

  • Everything in Free, across your whole stack
  • Vercel, Netlify, AWS, Firebase and your AI builder - all scanned automatically
  • Proof, not guesses: verify your domain and Rowly actually tries to break in, safely
  • Watched around the clock - automatic rescans, daily to monthly
  • Slack and email alerts the moment something new is exposed
  • Up to 3 projects and 3 teammates
  • Independent grades from Mozilla Observatory and SSL Labs
Get started

Pro+

…

For agencies and teams shipping apps for other people.

  • Everything in Pro, same depth of scanning
  • Up to 10 projects - one per client app
  • Up to 25 teammates with role-based access
  • Audit logs of every invite, role change and project update
  • Export the audit trail as CSV to hand to a client or reviewer
  • Priority support
Contact sales
Have questions? Check the FAQ

Find out before someone else does

One domain, about a minute, and you'll know exactly what strangers can reach. Free forever - no credit card, and never your database password.

Run a free audit