For apps built on Supabase
Know when someone is abusing your Supabase app.
Supahound reads your Supabase logs and catches cross-tenant reads, leaked service keys, credential stuffing and scraping within minutes. Each alert says what happened in plain English and gives you the SQL to fix it. Read-only access. No service-role key.
Early access: sign up free, no credit card. Features switch on as they ship.
Why does RLS alone not keep my Supabase data safe?
Row Level Security decides who can read each row, but a policy can be on and still be wrong. AI app builders write many policies fast, and a single using (true) or a missing owner check lets any signed-in user read everyone's data. Config scanners see that the policy exists. Only the traffic shows that someone is using the hole.
How does Supahound work?
Step 1
Connect read-onlyComing soon
Sign in with a magic link and connect your Supabase org with OAuth. Supahound asks for three read-only scopes: analytics:read, database:read and projects:read. It never sees your service-role key.
Step 2
Get a posture scanComing soon
Supahound checks RLS coverage, Security Advisor findings, views without security_invoker and newly exposed tables. The scan is free.
Step 3
Get told when it happensComing soon
On a paid plan, Supahound reads your edge logs every 1–2 minutes, groups suspicious requests into incidents and emails you what happened and the SQL to fix it.
What attacks does Supahound detect?
Cross-tenant readsComing soon
One signed-in user reads rows that belong to other users or teams. This is the classic broken-RLS leak.
Service-key misuseComing soon
Your service_role or secret key calls the API from a new network or a browser. That usually means the key leaked.
Credential stuffingComing soon
Bursts of failed sign-ins across many accounts from a small set of networks.
Scraping and bulk readsComing soon
One actor sends a request your app never sends, such as select=* with no filter on a users table, or pages through a table far deeper than your app does.
Database tamperingComing soon
A write to a column your app never writes, such as role, is_admin, plan or credits. That is how privilege escalation looks.
Cross-tenant reads, service-key misuse, credential stuffing and tampering alert from day one. The scraping detector learns your app's normal queries for 7 days first.
Which app builders does Supahound support?
Supahound watches the Supabase project, so it works the same however you built the app.
Lovable + Supabase
Chat-based builder for full-stack web apps, with a built-in backend on Supabase's open-source foundation.
Bolt.new + Supabase
StackBlitz's in-browser AI builder for web and mobile apps, with Bolt Cloud hosting and databases.
v0 + Supabase
Vercel's AI builder that generates Next.js apps and deploys them to Vercel.
Cursor + Supabase
AI code editor, a VS Code fork, whose agents edit code and call MCP tools such as Supabase's.
Claude Code + Supabase
Anthropic's terminal coding agent that edits code, runs commands and calls MCP tools.
Replit + Supabase
Browser IDE and hosting platform whose Agent builds and publishes full-stack apps from prompts.
Windsurf + Supabase
Cognition's agentic code editor, which can call MCP servers such as Supabase's hosted server.
GitHub Copilot + Supabase
GitHub's AI assistant and coding agent in IDEs, the CLI and GitHub.com.
Base44 + Supabase
Wix-owned AI app builder with its own managed backend, database, auth and hosting.
How much does Supahound cost?
Free
$0 forever
See if you are exposed.
Builder
$29 per project / month
Know when you are attacked, within minutes.
Agency
$19 per project / month, 10-project minimum
Watch every client app from one place.
Frequently asked questions
- What is Supahound?
- Supahound is abnormal-traffic monitoring for Supabase apps. It reads your project's logs with read-only access, detects abuse such as cross-tenant reads, leaked service keys, credential stuffing and scraping, and tells you in plain English what happened and how to fix it.
- How is Supahound different from the Supabase Security Advisor?
- The Security Advisor checks your configuration: it tells you if a table has no RLS. Supahound also watches traffic per actor, so it can tell you that one user is reading other users' rows right now, even when every table has RLS turned on but a policy is wrong.
- Does Supahound need my service-role key?
- No. You connect your Supabase org with OAuth and grant three read-only scopes: analytics:read, database:read and projects:read. Supahound stores the OAuth tokens sealed with a per-tenant key and never asks for a service-role or secret key.
- Does Supahound send my logs to an AI model?
- No raw logs reach a model. The incident summary model gets only structured features, such as counts, enums and an anonymous actor label, and every call uses zero data retention. If the model fails, Supahound sends template text instead.
- Which apps does Supahound work with?
- Any app with a Supabase backend, whether you built it with Lovable, Bolt, v0, Cursor, Claude Code or by hand. Supahound reads the Supabase project, not your frontend code.
- How much does Supahound cost?
- The posture scan is free for up to 3 projects. Runtime detection costs $29 per project per month on Builder, or $19 per project per month on Agency with a 10-project minimum.
Find out if someone is abusing your app
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.