Security, Privacy & Compliance
Preflight
Security scan for Supabase apps built with AI tools
Outside-in security scan for apps built with Lovable, Bolt.new or Cursor, checking for exposed database tables, keys, files, and whether one user can read
Overview
The Preflight homepage
Preflight performs automated security checks on web applications built with AI tools, particularly those using Supabase. The free scan is read-only and checks for exposed database tables, API keys in code bundles, open files, and security headers. The paid Proof Report ($29) goes deeper by signing in as two test accounts to verify whether one user can read another's data, and tests whether users can escalate their privileges. The service is built by a solo developer in Costa Rica and does not require access to code or service role keys.
Capabilities
- Read-only security scan checking for exposed tables, API keys, and files
- Two-user cross-account access testing as signed-in users
- Automated privilege escalation testing
- Dated evidence report for customers and compliance
- Rerunnable curl requests for each finding
- Weekly monitoring of outside security checks
- Support for apps without Supabase
- No service role key required
- Test data marked and removed automatically
- 14-day refund guarantee
Pricing
Free scan included with every app. Proof Report $29 one-time for Supabase apps. Monitor $12/mo (founding price until November 20, 2026, then $19/mo) for weekly outside checks on up to 3 apps. Launch Pack $79 one-time for Proof Reports on up to 3 apps with 90 days of re-scans.
Follow Preflight to get an email when they post a milestone, ship a new product or add a demo video.
Preflight fact sheet
| Community votes | 0 |
|---|---|
| Based in | Costa Rica |
| Website | preflightbot.com |
Preflight metrics
Vendor metrics for preflightbot.com: Ahrefs Domain Rating and Majestic link data, with the delta since the last review.
- Domain Rating
- 0
- no change since last check
- Trust Flow
- 0
- no change since last check
- Citation Flow
- 0
- no change since last check
- Referring domains
- 0
- no change since last check
- External backlinks
- 0
- no change since last check
Vendor Domain Rating (Ahrefs) checked 7 Nov 2026, spec changed 28 Oct 2026. Vendor Majestic data checked 28 Oct 2026, spec changed 28 Oct 2026. Link metrics supplied by Majestic. Trust Flow, Citation Flow and Topical Trust Flow are trademarks of Majestic-12 Ltd.
Preflight vendor domain
Open the vendor record
We read this from the registry's RDAP record on 3 Nov 2026, 09:52 UTC.
- Domain age
- 16 days
- Registered
- Expires
- Registrar
- Spaceship, Inc.
- DNSSEC
- Not signed
Preflight post-launch report
| Measure | At launch, then latest |
|---|---|
| Domain Rating (Ahrefs) | 0 to 0 no change since launch 28 Oct 2026, then 5 Nov 2026 |
| Trust Flow (Majestic) | 0 first measured 28 Oct 2026 |
| Referring domains (Majestic) | 0 first measured 28 Oct 2026 |
Day 8 since launch. Next receipt: day 30, 27 Nov 2026. Many things move these figures, so a change is not proof of cause. Only stored readings are shown.
About to launch?
Plan your launch with our free playbook, from preparing your listing to choosing more launch directories.
- The week before
- On the day
- Week one
- Beyond launch
Buyer questions
Do you need my code or service role key?
No. Preflight only accesses what is public plus two test accounts you create. A service role key is refused.
Will the Proof Report change my data?
Yes, a little, on purpose. It creates a few test rows and one file marked preflight-canary and removes them, and changes privilege fields on your test account and sets them back. Functions with side effects will run. The free scan is read-only.
What do you store, where, and for how long?
Reports and check results in a Cloudflare database for 90 days (counts, table names, masked ids, never row text). Test-account passwords are used only during the run and not stored. Account data is kept until you ask for deletion.
Doesn't Supabase already check this?
Supabase's Security Advisor lints configuration and you can test by hand with the Table Editor or RLS Tester. Preflight runs the two-user test against your live app and provides a dated report you can share with customers.
Can it miss things?
Yes. Every report lists what it did not check. The tool does not run webhook and edge-function checks, and will not catch all possible security issues.
Leave a review for Preflight
No customer reviews of Preflight yet. Write the first. Customer reviews are free and nobody can buy them.
Preflight has a free listing. The owner can unlock the full profile with a paid launch for $5:
- Founder story (locked)
- Milestones (locked)
- Demo video (locked)
- Dofollow website link (locked)
Compare with
| # | Product | DR | Votes |
|---|---|---|---|
| 1 |  roo |
0 no change since last check | 0 votes. Log in to vote for rooGBotVC as a buyer |
| 2 |  Heim |
5 +3 (up) since last check | 0 votes. Log in to vote for HeimWall as a buyer |
| 3 |  GhostforkZero-trust Git hosting where code is encrypted on your machine before it leaves |
0 no change since last check | 0 votes. Log in to vote for Ghostfork as a buyer |
| 4 |  SkyflowRuntime AI data control platform for enterprises |
67 no change since last check | 0 votes. Log in to vote for Skyflow as a buyer |