No hacking — a passive scan only looks at what your browser already downloads when it opens a page. Here's what I found:
6 of 15 load their Supabase database directly client-side. The public API key sits in the page source. That's fine if Row-Level Security is configured right — but it's one wrong setting away from "anyone can read the whole table."
14 of 15 ship no Content-Security-Policy — a simple, high-value hardening against script injection, almost always missing.
Is this theoretical? No. Two apps I audited with the owner's permission:
A social app: the profiles table — user names, cities, and a password hash — readable by a logged-out stranger. Closed in an afternoon.
