Validating before building: a security audit CLI for AI-built Supabase apps

AI tools produce working Supabase + Next.js apps quickly, and a lot of them go live with the database readable by anyone. CVE-2025-48757 covered 170+ apps with exactly this problem: Row Level Security missing or misconfigured.

The idea

One command that audits a project and prints what to fix:

• tables with RLS disabled
• policies that let everyone in, like USING (true)
• the service_role key in client code or public env vars
• API routes that read the database with no auth check
• webhooks with no signature verification
• public storage buckets

It would also ship skills that let Claude Code or Cursor apply the fixes. The core would be free and open source, with a paid version at $29–$49 one-time.

Where it stands

I have not written it yet. I'm testing demand first. My bar is 20 waitlist signups in 7 days; if it misses, I move on to the next idea.

What I'd like to know

1. What do you check by hand before launching a Supabase app today?
2. Which of these checks would you not trust a tool to get right?
3. Would you pay for this, or is a free checklist enough?

There is nothing to buy. If you want one email when it launches, the waitlist is here: https://shipaudit-ebon.vercel.app