Juan Almonte
@plugleakMaker
Maker of PlugLeak, a free security scan for AI-built apps.
- 1
- Launches
- 1
- Upvotes received
- 1
- Upvotes given
- 2
- Comments
Launches
Comments
Commented on PlugLeak · Nov 3, 2026
Great question. Yes: PlugLeak decodes every Supabase JWT it finds, so an anon key is treated as expected and only a service_role key is flagged critical. We don't query your tables with the anon key yet, because even a read-only request against someone's database goes beyond a passive scan. That deep RLS check is coming, limited to verified owners. Until then, a quick manual test: logged out, GET https:// .supabase.co/rest/v1/profiles?select=* with only the anon key. If it returns rows, RLS is off on that table.
Commented on PlugLeak · Oct 31, 2026
Day one for PlugLeak on DevHunt! Find leaked keys in your AI-built app in 20 seconds. Would love to hear how you'd use it, and what would make you switch.