FREE TOOL · MIT

Free Next.js + Supabase + Stripe security checker

Your AI agent shipped the app. Did it also ship your Stripe secret key, a table without RLS, or a webhook that anyone can call? This free checker runs 24 checks on your code locally. It needs no account, makes no network calls during the scan, and never uploads your code.

View on GitHub

Run it once

Node 18+ and git; not on npm yet.

npx github:edtrackai/nextjs-supabase-stripe-security-checker /path/to/your/app

Interactive runs print a one-line ad for our paid tools (off with --quiet; never in CI or --json).

Run it on every pull request

- uses: edtrackai/nextjs-supabase-stripe-security-checker@v0
  with:
    fail-on: high

The Action writes a job summary, adds file/line annotations and keeps one PR comment up to date. It needs contents: read, plus pull-requests: write only for the comment. Inputs: path, fail-on (critical | high | medium | low | none), comment, github-token. Full workflow: docs/github-action.md.

What it checks

Leaked keys, server auth, Supabase RLS, Data API grants (R5/R6), Stripe webhooks and checkout, and hardening.

Honest limits

It's heuristic. It doesn't follow data across files, can't see dashboard-created policies or your live project, and a clean run isn't proof of security.

Learn what each check catches

• Supabase “Permission Denied for Table”: the Data API Grants Change Scheduled for 30 Oct (R5/R6)
• Supabase Service Role Key Exposed? How to Check, Rotate and Stop It Happening Again (K checks)
• Stripe Webhook Signature Verification Failed in Next.js (S1/S2)
• 7 Security Bugs AI Agents Write in Next.js + Supabase + Stripe Apps (and the Rules That Stop Them)
• Cursor Rules for Next.js, Supabase, Stripe: Security-Focused

Ad (paid, ours): Want a deeper pass before launch? Launch Audit ($12; UK buyers pay $14.40 incl. VAT) runs 28 checks across RLS policies, keys, auth and Stripe webhooks, with an auditor agent that has no Edit or Write tools. It doesn't check Data API grants; this free checker does (R5/R6).

Free and MIT-licensed, from Stack & Ship (it's ours). On an interactive terminal the CLI prints one line labelled "Ad" about our paid tools; hide it with --quiet or NO_PROMO=1. It's off in CI, and the GitHub Action's comment and summary contain no ads.