I've been working on an open-source security auditor for Supabase projects for the last few weeks ( supabase-security on npm , MIT licensed, ~4k weekly downloads). Probes anonymously to find RLS gaps, public storage buckets, SECURITY DEFINER functions exposed to anon, that kind of thing.

This morning I shipped a new feature: a --discover mode. Keyless — it walks your local repo, pulls every table / RPC / bucket reference from .from() / .rpc() / .storage.from() call sites, then probes only the surface your app actually uses with the public anon key. No PAT, no admin token, no signup.

Before announcing it, I wanted to run it against my own production CRM as the final QA test.…