Open tables
A table that returns rows to the anon key is called out by name and count. The contents stay on your database.
For Bolt builders
Bolt got you live. The score shows what it left open.
Bolt projects often ship with Supabase wired up and a polished first screen. The risky part is the database rules and whatever landed in the client bundle. WebFixScore checks the public site, then writes the repair as a prompt you can paste into Bolt.
Firebase left public
If a Realtime Database URL is in the page, we ask for permission, not for a dump. Permission denied is a pass.
Shared hosting headers
Bolt hosting will not invent a Content-Security-Policy for you. The report says what to add.
What the scan looks for
- Supabase and Firebase exposure
- Client-side secrets
- HTTPS and headers
- SEO basics
- Mobile speed
Do I need a Bolt account to scan?+
No. Anyone who owns the site, or is allowed to test it, can paste the URL.
What does $9 buy?+
The steps and the copy-paste prompt for every issue on that scan. The issue list itself is free.