Lock down the database behind your app.
Supabase and Firebase make it fast to build an app, and easy to leave your data readable by anyone. BurstLayer checks your access rules, finds what is exposed and helps you close it.
Your app's database can be reached straight from the browser.
That is how Supabase and Firebase are designed, and it is safe only when the access rules are right. Rules decide who can read or change each table. When one is missing, anyone who opens your app can download everything in that table.
What goes wrong in app backends
These are the leaks we find most often in apps built quickly, by hand or with AI tools.
Tables anyone can read
Tables without access rules, so every row is public. We list them and write the rule for you to approve.
Rules that let anyone write
Rules that let any visitor add or change data. We spot them and suggest a safe version.
Public file storage
Storage buckets holding private files that anyone can read. We make them private.
Admin keys inside the app
The service key, which skips every rule, shipped inside the app by mistake. We find it and help you replace it.
Login abuse
Bots creating fake accounts or guessing passwords. We limit sign-ups and logins.
Unusual data downloads
Someone pulling far more rows than any normal user would. We alert you while it is happening.
Every table, checked and explained.
Each table shows who can read it today. When a rule is missing, BurstLayer drafts one, tests it against the requests your app makes and waits for your approval.
- Who can read each table, in plain words
- Rules written and tested for you
- Applied with one approval
- profilesAnyone can readApprove rule
- ordersOnly the ownerSafe
- waitlistAnyone can add, nobody can readSafe
- avatars (files)Anyone can listApprove rule
How BurstLayer protects Supabase and Firebase
We read your rules, settings and logs. We never read the rows inside your tables.
Rule checks for every table
Missing and too-open rules are found as soon as you connect, and again after every change.
Rules written for you
Each fix is explained in plain words and in code, and you approve it with one click.
Key leak detection
Admin keys in your app, repository or deploy settings are found before anyone abuses them.
Storage checks
Buckets with private files are flagged when they are public or listable.
Live usage alerts
Unusual downloads, sign-up floods and password guessing are reported as they happen.
Ask Vigil
Ask our security AI "who can read my orders table?" and get a straight answer.
Connect a project in under a minute.
Sign in with your Supabase or Firebase account and pick a project. BurstLayer reads your rules and settings, never the data inside your tables.
$ npx burstlayer connect supabaseOpening your browser to sign in✓ Project acme-prod linked (read-only)✓ 2 tables can be read by anyone. Rules drafted for review.
You can also connect from the BurstLayer dashboard without using the command line.
- 01
Sign in and pick a project
Supabase and Firebase both connect with a normal sign-in.
- 02
See what is exposed
Tables, storage and keys are checked within a minute.
- 03
Approve the rules
Each drafted rule is tested against your app's real requests before you apply it.
The products behind it
Each one works on its own. Together they cover Supabase & Firebase, from the network edge to the last line of code.
Questions, answered.
Do you read my users' data?+
No. We read your rules, settings and logs. The rows in your tables stay private.
Will fixing a rule break my app?+
We test each rule against the requests your app makes today, and show you anything it would block before you apply it.
I built my app with an AI tool. Will this work?+
Yes. Apps built with Lovable, Bolt, swarmz and similar tools often run on Supabase or Firebase, and this is exactly the check they need.
Check your database rules before someone else does.
Free for your first project. Sign in, pick a project and see every table that anyone can read.