Database rules switched off
Tables anyone can read, or change, with the public key every app ships with.
✓Access rules on every table, tested from the outside.
Sept 2026 · 16,326 open databases
Your AI-built app may be showing your users' data to anyone.
200 OK · NO LOGIN NEEDED2,148 rows
{ "email": "emma.k•••@gmail.com",
"phone": "+1 415 ••• 2291",
"message": "can we move my session to friday?" },
{ "email": "daniel.r•••@outlook.com",
"phone": "+44 7700 ••• 812",
"message": "my new address is 14 Oak St, flat 3" },
{ "email": "sofia.m•••@icloud.com",
"phone": "+1 647 ••• 0934",
"message": "please don't share this with my boss" },
{ "email": "j.okafor•••@gmail.com",
"phone": "+1 312 ••• 7716",
"message": "here's the photo of the contract" },
{ "email": "lena.w•••@yahoo.com",
"phone": "+44 7911 ••• 245",
"message": "my results came back, call me" },
{ "email": "mark.t•••@gmail.com",
"phone": "+1 905 ••• 1180",
"message": "the door code is 4•••" },
{ "email": "aisha.b•••@hotmail.com",
"phone": "+1 646 ••• 5527",
"message": "booked for my daughter, she's 9" },
{ "email": "tom.h•••@gmail.com",
"phone": "+44 7456 ••• 390",
"message": "card ending 4•••, is that ok?" },
{ "email": "emma.k•••@gmail.com",
"phone": "+1 415 ••• 2291",
"message": "can we move my session to friday?" },
{ "email": "daniel.r•••@outlook.com",
"phone": "+44 7700 ••• 812",
"message": "my new address is 14 Oak St, flat 3" },
{ "email": "sofia.m•••@icloud.com",
"phone": "+1 647 ••• 0934",
"message": "please don't share this with my boss" },
{ "email": "j.okafor•••@gmail.com",
"phone": "+1 312 ••• 7716",
"message": "here's the photo of the contract" },
{ "email": "lena.w•••@yahoo.com",
"phone": "+44 7911 ••• 245",
"message": "my results came back, call me" },
{ "email": "mark.t•••@gmail.com",
"phone": "+1 905 ••• 1180",
"message": "the door code is 4•••" },
{ "email": "aisha.b•••@hotmail.com",
"phone": "+1 646 ••• 5527",
"message": "booked for my daughter, she's 9" },
{ "email": "tom.h•••@gmail.com",
"phone": "+44 7456 ••• 390",
"message": "card ending 4•••, is that ok?" },
{ "code": "42501",
"message":
"permission denied for table users" }
Exposed
✓ Locked
Before the checkSame request, after the check
No hacking needed: one request from a browser. I check your app the way an attacker would, close every door, and explain it in plain words.
Check my app Reply within one working day
UpGuard research · September 2026
16,326
app databases anyone could read.
Names, addresses, phone numbers, private conversations — many of them in apps built quickly with AI coding tools. Read the report coverage
What AI tools often leave open
Four doors I check first.
Secret keys inside the app
Payment, email or AI keys anyone can pull out of the app and run up your bill with.
✓Keys moved to the server; the old ones replaced.
No login check on the server
The screen hides other people's data. The server still hands it out.
✓Every request checks who is asking.
Public file storage
Uploaded photos, IDs and documents open to anyone who has the link.
✓Private storage with links that expire.
How it works
Find it before someone else does.
- 01
Send me the link
Your app or website, and what you built it with. No passwords, no code needed to start.
- 02
I test it like an attacker
From the outside, the way someone would who wants your users' data: the database, keys, logins and files.
- 03
You get it in plain words
What's open, how bad it is, and the exact request that proved it. I fix it, or your developer does — then I test again.
Send me your app's link.
I'll tell you what's open.
No obligation. I read every message myself and reply within one working day.
Do you need my code or passwords?
Not to start. The first look is from the outside, like an attacker's. For fixes you add me to the project, and remove me when we're done.
My app has no users yet.
That's the best time. Closing the doors before launch is quicker than writing a breach email after.
Will anyone else hear what you find?
No. What I find stays between us, and I delete any data I happen to see.
What can you check?
Web apps and iOS / Android apps built with Lovable, Bolt, Cursor, Replit, Base44, v0 or FlutterFlow, on Supabase, Firebase or your own server.