On 11 August 2026 two apps I had permission to scan came back from our scanner with the same two rows: "Database access: Not applicable" and "Storage buckets: Not applicable". Both apps run on Supabase and call it from the browser, so neither row could have been right. Working out why turned up three separate defects, and each one turned a question we could not answer into a clean result.

The scanner checks an app from outside, with what any visitor has: the page, the JavaScript it loads, and the publishable key that ships in that JavaScript. A check can end three ways. It found something, it looked and found nothing, or it could not look. We print the second as "All good" or "Not applicable" and the third as "Couldn't check", and all three defects below turned the third into the second.

Every Supabase response in this post was measured that day against real projects, so some of them may have changed since.

1.…