Backend exposure test

An AI builder can create a table in seconds. The rule that says who is allowed to read it is a separate step, and it is the step that gets left for later. Meanwhile the browser key your app uses is published inside your app by design. That is not a mistake, it is how the key works. The mistake is a table with no rule behind it, because that table will answer anyone who copies the key out of your page.

This is not theory. It is the shape of CVE-2025-48757, which affected a long list of apps built the same way, and it is the shape of the Moltbook exposure, where records were reachable without signing in. In both cases the app worked perfectly for its users the entire time. There is nothing to notice from the inside. A table that answers everybody looks exactly like a table that answers the right people.

The tool reads your published page, finds the backend address and the browser key your own app ships, and asks that backend which tables respond to an anonymous request. It reports the number of tables that answered and their names. It never reads the contents of a row, never stores one, and never shows one. A table name is enough to tell you where to look, and it is where the evidence stops.

Tables are not the only thing a backend answers for. The same run reads file buckets, asking which ones list their objects to a stranger and whether the first listed object is readable without a session, and it reads your public sign in settings, so you can see whether accounts are open, whether email confirmation is switched off and which providers are enabled. On a Firebase app it asks the same question of the common collections and the configured storage bucket. Every answer is a name and a count. Nothing stored here is a row, a file name or a document.

Run this only on an app you own or are authorized to test, which is what the box above the button confirms. A table appearing here does not always mean a problem, because some tables are meant to be public, and this tool cannot know which of yours those are. What it can do is hand you the list, so the answer comes from you rather than from a guess. Nothing is written, nothing signs in and no function on your backend is ever called.

This page is for running the check. The finding page explains the issue itself, and it is the page to read or link when you want the explanation rather than the test. Read the finding page.