Building LeakScope: Supabase security scanner – current roadmap + feedback welcome

Hey everyone,

We're a small team working on LeakScope, a black-box tool that scans Supabase apps for common security issues by just pasting the public URL. No login, no credentials needed — it looks at what's exposed publicly (JS bundles, network requests, endpoints) and flags things like leaked keys (anon/service_role, third-party tokens), weak/missing RLS, IDOR risks, exposed data, etc.

Right now we're focused on the next steps:

• Deeper scans where you can optionally authorize your Supabase project (e.g., via meta tag or temp key) for more accurate internal checks without making anything public.
• Scheduled/continuous monitoring (like weekly auto-scans + alerts if new issues appear).
• A CLI version for local use, CI/CD pipelines, or bulk checks.

We're trying to keep it useful for vibe coders and small teams who ship quickly but want to catch the obvious stuff early.

Curious what you think would be most helpful next:

• Prioritize the auth-enabled deeper scans?
• Get monitoring/alerts working first?
• Focus on the CLI (any specific features/commands you'd want)?
• Something else entirely (better reports, integrations, etc.)?

If you've scanned an app already or have thoughts on Supabase security pitfalls, we'd really appreciate hearing them — no promo, just trying to build something that actually helps.

Thanks!