How the probe works
LeakScan finds the Supabase project address and public key in your live app, then requests a single row from exposed tables with no user signed in. If a row comes back, anyone on the internet can read that table.
The probe only reads. It never inserts, updates or deletes, and it runs only after you prove you own the domain.
Why it complements the database lints
The lints read your settings; the probe tests the result. Together they catch both the table with row-level security switched off and the table with a policy that quietly allows everyone.
What the report shows
A list of tables that answered, the columns that came back (never the values), and a fix prompt that locks each table down to its owner.
Common questions
Will the probe show up in my logs?
Yes, as a handful of read requests from LeakScan's scanner. That is the point: it is exactly what an attacker with your public key could do.
Can I test my own tables by hand?
Yes. Our guide on checking whether your Supabase tables are public shows the one request to make with your own project's key.