I scanned my own production project last week and found 17 publicly readable records I had no idea about. users, posts, internal admin records — anyone with the public URL could read or modify them. I'll do the same scan for yours.
ALTER TABLE … ENABLE RLS, REVOKE ALL ON … FROM anon, ALTER FUNCTION … SET search_path. Paste into the Supabase SQL editor.BEGIN; … ROLLBACK; first to verify, then commit.PocketBase v0.21+ tightens the default rules but old projects still inherit permissive @request rules. Audit before someone notices.
I built and shipped pocketbase-security-skill (open source MIT) — the only auditor with active anon-key probe + MCP server for AI coding agents. SaaS competitors charge $49–499/month for what's essentially metadata reads. This is the manual + faster version of that, run by me directly.
What permissions do you need? your PocketBase admin auth token. Read access is enough — the auditor never writes to your project.
Will you keep the token? No. Used only for the audit run. Deleted from my machine after the report is delivered. You can rotate it the moment you receive the report.
What if you find nothing? Money-back. I've never run this on a project that's been live >6 months and found zero issues, but if it happens to you, you don't pay.
Do you offer the fix too? The report ships with copy-paste SQL on every finding. If you want me to apply the fixes for you, that's a separate $199 add-on (we'll discuss after you see the report).
I'd rather just use the open-source tool. Go ahead — github.com/Perufitlife/pocketbase-security-skill. The $99 saves you the install + interpretation + writing the executive summary for your team. Worth it for some, not for others.