Check Softr security
Is your Softr app production-ready?
Free, platform-independent scan built for Softr apps. It checks the gaps typical for Softr — access control, visible keys, GDPR — and delivers a traceable Go/Iterate/Stop verdict with versioned rule codes.
Scan your Softr app for free nowTypical weaknesses in Softr apps
Softr apps often sit on Airtable/Google Sheets — access rules on the data source and visible connections should be checked.
Rules the scan weights for Softr
Supabase service_role key in the client
Decodes JWTs in the bundle and reports the `service_role` claim, which bypasses RLS entirely.
RSC-SEC-015Database tables granted to the anon role
Queries the schema endpoint with the client key the app publishes itself and lists the tables granted to the anon role — without fetching a row or a row count. Granted is not the same as readable: whether rows come out depends on Row Level Security.
RSC-SEC-018Protected area guarded only in the browser
Detects admin/account routes the client router knows while the guard lives purely as a condition in the bundle — anyone with the URL gets in.
RSC-SEC-050Tables without Row Level Security
Collects every `create table` and every `enable row level security` across all migrations and reports tables that are never protected.
RSC-SEC-051RLS policy allows everyone
Finds policies with `using (true)` — RLS is on but has no effect.
RSC-PRV-001Google Fonts loaded at runtime
Finds references to fonts.googleapis.com/gstatic.com that send visitors' IP addresses to Google.
RSC-PRV-002US tracking without visible consent
Detects analytics and pixel scripts with third-country transfer in the shipped markup.
Frequently asked
- Is the scan free for Softr apps?
- Yes. The external scan is completely free and anonymous — you only enter the URL of your Softr app.
- Do you need access to my Softr account?
- No. The scan only inspects what your app serves publicly. It goes deeper optionally via read-only repo access or after a domain proof — both strictly opt-in.