How this check works
Apps built with Lovable, Bolt or v0 usually talk to Supabase straight from the browser, so your project URL and its public key (anon or sb_publishable_…) are inside your JavaScript. That is normal: the key is meant to be public. Scanaris finds them, asks the Supabase API which tables it exposes and, for each one, sends a HEAD request with Prefer: count=exact. The answer carries the number of rows a visitor without a session can see, and no data at all. If the API does not publish its table list, it tries the names AI tools use most (profiles, users, orders, messages…). For Firebase, it checks whether the Realtime Database root answers a read without a session.
What a finding means
A table with more than zero rows visible anonymously is readable by anyone who opens your site: one request with the public key and they get the whole table. This is the exact pattern of the Lovable vulnerability (CVE-2025-48757). With Row Level Security on and sensible policies, an anonymous visitor sees zero rows, which is why "0" never raises a finding.
How to fix it in Supabase
List the tables without RLS, turn it on and write one policy per operation. Leave public read access only where the data is meant to be public (a blog, a product catalogue).
-- Tables in the public schema without RLS
select c.relname
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;
alter table public.profiles enable row level security;
create policy "profiles: own rows" on public.profiles
for select to authenticated
using ((select auth.uid()) = id);How to fix it in Firebase
Replace the test-mode rules with rules that deny by default and only open what each user owns:
{
"rules": {
".read": false,
".write": false,
"users": {
"$uid": {
".read": "auth != null && auth.uid === $uid",
".write": "auth != null && auth.uid === $uid"
}
}
}
}The step-by-step version for each stack is in the Supabase guide and the Firebase guide.
Frequently asked questions
Does Scanaris read my data?
No. It only reads the row count that the API returns in a header; the requests carry no table contents and nothing is stored.
Can I hide the public key instead?
No, and you do not need to: the browser needs it to talk to Supabase. What protects your data is RLS, not hiding the key.