I will do a supabase security audit of your lovable, bolt or vibe coded app

If your app was built with Lovable, Bolt, Replit, v0, Cursor or Claude Code on top of Supabase, there is a real chance some of your data can be read by anyone who opens the browser console.

In a 2026 scan of 1,072 Supabase-backed vibe coded apps, Symbiotic Security found 98% had at least one vulnerability and 16% had a critical one.

What I check:

• Every table: can the public anon key read or write it?
• Service role or third-party API keys shipped to the browser
• Storage buckets that list or serve private files
• Auth: email confirmation, password reset, who can edit whose data
• Edge functions and API routes with no auth check

What you get: a plain-English report sorted by severity, with proof for each finding and the exact SQL policy or code change to fix it. On Audit and fix and Full hardening I apply the fixes, test every flow they touch, and re-run the audit.

I only test apps you own or have permission to test. Send me the live URL first and I'll tell you which package makes sense.