Is your WordPress app production-ready?

Supabase service_role key in the client

Decodes JWTs in the bundle and reports the `service_role` claim, which bypasses RLS entirely.

Database tables granted to the anon role

Queries the schema endpoint with the client key the app publishes itself and lists the tables granted to the anon role — without fetching a row or a row count. Granted is not the same as readable: whether rows come out depends on Row Level Security.

Protected area guarded only in the browser

Detects admin/account routes the client router knows while the guard lives purely as a condition in the bundle — anyone with the URL gets in.

Tables without Row Level Security

Collects every `create table` and every `enable row level security` across all migrations and reports tables that are never protected.

RLS policy allows everyone

Finds policies with `using (true)` — RLS is on but has no effect.

Google Fonts loaded at runtime

Finds references to fonts.googleapis.com/gstatic.com that send visitors' IP addresses to Google.

US trackers embedded in the shipped code

Detects analytics and pixel scripts with third-country transfer (Google Analytics/Tag Manager, Meta Pixel, Hotjar, Segment) in the shipped markup. Whether they load only after consent is not checked by this rule — the browser check does that (RSC-PRV-005).