Signals Source and build
The database is addressed straight from the browser
- Category
- Source and build
- Direction
- Pushes the score up
- Weight
- +6
What it is
What is visible in the shipped code. One signal is not a verdict. The score is the whole weighted set, not any single line of it.
How it is weighted
6 points is deliberately light. This one is a hint, and it is only interesting alongside others.
What to do about it
Go and check row-level security or the rules file right now. If the answer is 'allow all', anyone who opens devtools owns the table — fix that before anything on this page.
Where it fires
Of the homepages we scan as worked examples, this signal fired on 2:
- stripe.com 15/100 — Supabase is queried directly from the page, so row-level security or rules are the only thing standing between a visitor and the table. This is not proof they are off — it is the reason to go and check, because "allow all" is what makes the demo work.
- tailwindcss.com 75/100 — Supabase is queried directly from the page, so row-level security or rules are the only thing standing between a visitor and the table. This is not proof they are off — it is the reason to go and check, because "allow all" is what makes the demo work.