RLS Watch

RLS Watch is a web service that runs security checks on apps built with AI builders such as Lovable, Bolt, Replit, Cursor, and v0. Users submit a URL they own, and the service reads it without writing anything, then returns a plain-English report with a fix prompt that can be pasted back into the builder.

What It Is

RLS Watch is a security scanner aimed at apps shipped quickly with AI coding tools. It looks for common exposures: secret keys in client JavaScript, Supabase tables with row-level security disabled, and public .env files.

How the Checks Work

Before ownership is proven, only a single passive read of the public page is made. After the user claims the app by ticking an ownership box and publishing a token (a meta tag, a /.well-known file, or a DNS TXT record), the full check runs. It remains read-only, with no logins, form posts, or database writes.

The full check covers:

• Keys in JavaScript, including OpenAI, Stripe secrets, Supabase service_role, AWS, GitHub, and private keys
• Supabase RLS, using a read-only select with limit 1 via the anon key
• Firebase open rules, via a shallow Realtime Database read and one Firestore page
• Public .env and .git files
• Open CORS, where a foreign Origin is reflected
• Missing security headers and mixed content

Reports and Fix Prompts

Each finding includes a severity, an explanation, evidence such as the file and a masked key, and ready-to-paste prompts for Lovable and Cursor that ask for the smallest change that fixes the issue. A weekly Monday job can rerun checks on verified apps, and email digests list what is new and what has cleared.