One-time scanner
Supahound vs SupaExplorer: point-in-time audits vs live traffic detection
SupaExplorer is a free leaked-key URL scanner and Chrome extension, plus a low-cost platform that audits Supabase projects. Supahound reads each project's edge logs and alerts on abnormal traffic per user. SupaExplorer shows what is exposed at the moment you scan; Supahound shows who is using the exposure.
Last updated
How do Supahound and SupaExplorer compare?
| Question | Supahound | SupaExplorer |
|---|---|---|
| Finds leaked keys in your front end? | No. It detects service-key misuse in traffic. | Yes. The URL scanner checks pages and JS files. |
| Checks RLS coverage? | Yes. Free daily posture scan. | Yes. Project Audit shows RLS status per table. |
| Watches live Supabase traffic? | Yes. Edge logs every 1–2 minutes on paid plans. | No. The site does not mention logs or traffic. |
| Per-user detection? | Yes. Detectors run per actor. | Not described. |
| Needs a service-role key? | No. Read-only OAuth. | Not stated. The site says only "Connect your Supabase project directly". |
| Price | Free posture scan; $29 per project per month for detection. | Free tools; platform $9 per month, $90 per year or $249 lifetime. |
What does SupaExplorer do well?
- The URL scanner fetches a page and its JS files to find exposed Supabase URLs, anon keys and service role keys, and shows where each one sits.
- Project Audit gives a table inventory with RLS status and shows which tables are publicly readable.
- Low price, with a lifetime option, and audit snapshots you can compare over time to catch regressions.
- A free RLS policy generator and a library of 25+ RLS patterns.
What does SupaExplorer not cover?
- Scans and audits are point-in-time. The site does not mention reading Supabase logs or traffic.
- No per-user or per-actor detection is described.
- The site does not say how Project Audit connects to a Supabase project: OAuth, token or key.
How much does SupaExplorer cost?
The free tools (URL scanner, Chrome extension, checklist and RLS policy generator) need no signup. The paid Cloud Platform is one plan with every feature: $9 per month, $90 per year or $249 lifetime; a promotion showed 25% off when we checked. Limits are 10 teams, 20 members per team, 50 domains per team and 200 reports per domain. Supahound's posture scan is free; runtime detection is $29 per project per month (pricing).
Which one should I choose?
Choose SupaExplorer if you want a cheap, quick check for leaked keys and tables without RLS before launch.
Choose Supahound if you are past launch and want alerts when someone actually reads across tenants, misuses a service key or bulk-exports a table.
Frequently asked questions
- Can SupaExplorer and Supahound run on the same project?
- Yes. Use SupaExplorer's URL scanner to find a key in your bundle before launch. Use Supahound to see whether anyone uses a leaked key against your project after launch.
- Does SupaExplorer need my service-role key?
- Its site says only "Connect your Supabase project directly" and does not name the credential. Supahound uses read-only OAuth with the read-only analytics:read, database:read and projects:read scopes and never asks for a service-role key.
- Is a point-in-time audit enough?
- An audit tells you which tables are open today. It cannot tell you that one signed-in user started reading every other user's rows an hour ago. That needs the logs, which is what Supahound reads.
Find out if someone is abusing your app
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.