Secure
Security scan
Automatic security scan of your project.— RLS policies, exposed secrets, open endpoints, vulnerable dependencies.
Overview
Master continuously scans the project for common security vulnerabilities and requires fixing critical findings before publishing. The scan is free.
What the scan checks
- RLS politiky — missing or overly permissive rules.
- Exposed secrets — API keys in code, env variables sent to the client.
- Open edge functions — functions without authentication.
- Storage politiky — buckets with public read/write where they shouldn't.
- npm vulnerabilities — known CVEs in dependencies.
- Auth flow — storing roles in the profiles table (privilege escalation).
When the scan runs
- After every database migration.
- Before publishing — critical findings block publishing.
- Manually via Settings → Security → Run scan.
Output and fixes
The scan returns a list of findings with a level (info / warn / critical). Most findings have a "Fix with agent" button.
Critical findings block publishing until you resolve or explicitly dismiss them.