Sekrd connects to your Supabase and Firebase to validate RLS policy logic — not just presence. USING(true) looks safe. It isn't.
No signup required for free scans. 3 scans/month.
8
Security providers
60s
Average scan time
4
IDE fix formats
$0
To get started
How it works
We fetch your app's HTML and JavaScript, scan for exposed secrets, check HTTP headers, and query OSV for dependency CVEs.
Link Supabase or Firebase. We analyze every RLS policy, parse Firestore rules, check auth config, and audit storage buckets.
Copy-paste fix prompts tailored for Cursor, Lovable, Bolt, and Claude Code. Fix each issue in seconds, not hours.
Security checks
Every scan runs these checks in parallel. Results in 60 seconds.
Secrets Scanner
sk_live_, API keys, JWTs in client code
Supabase RLS
Policy logic — catches USING(true)
Firebase Rules
Firestore, RTDB, Storage rules audit
Auth Flow
Unprotected endpoints, CSRF, cookies
DAST / Nuclei
Headers, CORS, XSS, open redirects
Payments
Stripe keys, unsigned webhooks
Dependencies
CVE scanning via OSV querybatch
Cost Exposure
$/day estimate per leaked key
The problem
USING(true) = RLS "enabled" but database fully open.What other scanners see
✓ RLS: enabled ✓ Policies: 3 found ✓ Auth: configured Result: PASS ✓
What Sekrd finds
⚠ CRITICAL: users table
Policy: USING (true)
→ Anyone with anon key
can read ALL user data
Fix: USING (auth.uid() = id)Why Sekrd
Pricing
Start free. Upgrade when you need deep auditing.
Quick external checks
Full deep audit
Continuous monitoring
Join developers who ship with confidence. Your first scan is free — no signup needed.