VibeVigilGuides
One question per page. Plain words. A free scan at the top.
- Can people download my .env file? →
They can if the host serves it. A scan requests /.env and /.git/config and ignores an HTML page that is not the file.
- Is a Supabase service role key safe in the browser? →
No. The service role key skips row security. Keep it on the server. Rotate it if it shipped in JavaScript.
- Is the Supabase anon key a secret? →
No. The anon key is meant to be in the browser. Row security is what protects your data.
- What is row level security? →
Row level security decides which rows a stranger can read in Supabase. If it is off, the anon key can read the table.
- Which security headers should my app send? →
Five headers help a public app: Content-Security-Policy, HSTS, framing protection, nosniff, and Referrer-Policy.
One question. One plain answer.
These pages explain a single check. They do not replace a scan of your own URL.
Scan a site you own. It is free. No account.
You see the report first. Saving the site is optional.