# ProdCanary

> ProdCanary is a paid defensive security review for vibe-coded apps built with Lovable, Bolt, Cursor, Supabase and Firebase. You upload a .zip of your own project or paste its public GitHub repo link; ProdCanary reviews the code statically (it never contacts your live site or runs your code) for exposed keys, Supabase RLS gaps, over-broad policies and grants, SECURITY DEFINER functions callable by anonymous users, open Firebase rules and storage, and API routes with no auth. You get a plain-English report and copy-paste fix prompts for your AI editor. Uploads are deleted right after the scan.

- Free scan: https://prodcanary.com/#scan (top 3 risks in seconds)
- Own data: in a review of 30 public Lovable and Bolt repos built on Supabase, 33% had at least one critical or high-severity issue (small sample, directional).
- Not affiliated with Supabase, Lovable, Bolt, Firebase or Cursor.

## Guides

- [Supabase "RLS Disabled in Public" warning: how to fix it](https://prodcanary.com/guides/supabase-rls-disabled-in-public-fix/): What Supabase's "RLS Disabled in Public" (lint 0013) error means, the exact SQL to fix it, and how to check your policies actually work.
- [Supabase Oct 30, 2026 change: tables no longer auto-exposed to the Data API](https://prodcanary.com/guides/supabase-tables-not-exposed-data-api-oct-30-2026/): What changes on October 30, 2026 when Supabase stops auto-granting new public tables to the Data API, how to fix 42501 errors safely, and what not to do.
- [Supabase service_role key in your frontend: what to do now](https://prodcanary.com/guides/supabase-service-role-key-in-frontend/): Why a Supabase service_role or secret key in browser code bypasses every RLS policy, how to rotate it, and how to move privileged calls to the server.
- [Supabase SECURITY DEFINER functions: the risk and the fix](https://prodcanary.com/guides/supabase-security-definer-function-risk/): Why a SECURITY DEFINER function callable by anon or authenticated can bypass RLS in Supabase, and the SQL to revoke, switch to invoker, or lock it down.
- [Firebase rules "allow read, write: if true": how to fix it](https://prodcanary.com/guides/firebase-rules-allow-read-write-if-true-fix/): Why Firestore or Realtime Database rules with allow read, write: if true are unsafe in production, and secure owner-based rules you can copy, test and deploy.
- [Lovable app exposed API key: how to find and fix it](https://prodcanary.com/guides/lovable-app-exposed-api-key/): How API keys end up in Lovable app code, which Supabase keys are safe to ship, how to move secrets to server-side functions, and how to rotate a leaked key.
- [Bolt.new app security checklist before you launch](https://prodcanary.com/guides/bolt-new-app-security-checklist/): A practical pre-launch security checklist for Bolt.new apps on Supabase or Firebase: secrets, RLS, grants, functions, storage, rules and API routes.
- [Next.js API route without auth: how to protect it](https://prodcanary.com/guides/nextjs-api-route-without-auth/): Why Next.js Route Handlers and Server Actions must check auth themselves, plus copy-paste code for 401/403 checks and a central verifySession helper.

## Optional

- [All guides](https://prodcanary.com/guides/)
- [Full text for LLMs](https://prodcanary.com/llms-full.txt)