Free tools
Free tools to see who can read your data.
Start with a quick look at your access rules or your site’s security headers, work out what a leak would cost, or open a complete report from a real lab run. No account needed for any of them.
Tools
Free RLS check
Paste a public repo. We read supabase/migrations and flag eight risky patterns, each with the file, the line and what it means.
Free headers check
Type your site’s address. We load your public home page once, like any visitor, and grade HTTPS, the certificate, security headers, cookie flags and mixed content, with the fix for your host.
Leak cost calculator
Plain maths with your own figures: notifying people, answering their questions, the time to fix it. Plus the UK’s 72-hour reporting rule.
Sample proof report
The full report from our deliberately leaky demo app: the exploit, the exposed columns, the fix, the proof as three identities, and the key scan.
Which one?
From a quick look to a proven fix.
The free tools tell you where to look. Only the lab tells you what a stranger can actually read, and hands you a fix that has been tested.
01Look
Free RLS check
Seconds. Reads your SQL as text.
- Risky rules, with file and line
- Can’t tell intended from leaking
- No fix
Or grade your site’s HTTPS and headers with the headers check.
02Weigh
Leak cost calculator
Minutes. Your own costs, added up.
- What telling people would cost
- Who to report to in the UK
- Doesn’t look at your app
03Prove
Full lab check
About 3.5 minutes (median, lab study, n=20). Free for your first app.
- Rebuilds your database from its migrations
- Reads as anon, stranger and owner
- Writes the fix and proves it
- Scans code and git history for keys
In your agent
Your coding agent can run the free check too.
The RLS check is a public API endpoint and a tool in the PatchLabs MCP server, so Cursor, Claude Code or any MCP client can check a repo before you ship.
Not yet a separate tool: a standalone git-history key check. Today the key scan runs inside every full check, across your code and its full git history. How the key scan works.