Open Table Scanner — Security Audit Tools for Vibe-Coded Apps

POC tools to test whether apps built with Base44 and Lovable (Supabase) properly secure their database tables.

The Problem

Vibe-coding and no-code platforms like Base44 and Lovable make it easy for non-technical users to build web applications. However, these users are often unaware of critical security settings — such as Supabase Row Level Security (RLS) or Base44 entity permissions — leaving database tables publicly accessible and exposing sensitive data.

These tools let site owners audit their own applications to check whether their data is exposed, and take action to fix it.

Scripts

Script	Target Platform	How to Run
base44-scanner.js	Base44 apps	Browser DevTools Console
supabase-dumper.user.js	Lovable apps (Supabase)	Tampermonkey userscript

---

Base44 Scanner

Scans all entity tables in a Base44 application and downloads any accessible data as a ZIP file.

How It Works

1. Resolves the App ID from the current domain via Base44's public API
2. Fetches entity metadata to discover all table names
3. Iterates through each entity and attempts to read its data
4. Packages all accessible data into a ZIP file (one JSON file per entity)

Prerequisites

• You must be logged in to the Base44 site (the script uses the auth token from localStorage)
• If you are not logged in, the script will automatically redirect you to the login page

Usage

1. Navigate to the Base44 site you want to audit
2. Open DevTools (F12 or Ctrl+Shift+I)
3. Go to the Console tab
4. Paste the contents of base44-scanner.js and press Enter
5. The script will run and download a ZIP file if any data is accessible

Output

• File: Full_Backup_<domain>_<date>.zip
• Contents: One JSON file per entity, each containing the entity name, app ID, record count, and all accessible records

---

Supabase Dumper (Lovable)

Intercepts Supabase API keys from a Lovable-built application and attempts to dump all accessible database tables.

How It Works

1. Hooks window.fetch at document start to intercept all outgoing requests
2. When it detects a request to supabase.co, it captures the API key and base URL
3. Scans all loaded JavaScript files for .from("table_name") patterns to discover table names
4. Also tries a list of common table names (users, profiles, contacts, etc.)
5. Attempts to read data from each discovered table via Supabase REST API
6. Packages all accessible data into a ZIP file

Prerequisites

• Tampermonkey browser extension installed

Installation

1. Open Tampermonkey in your browser
2. Click Create a new script
3. Replace the default content with the contents of supabase-dumper.user.js
4. Click File → Save (or Ctrl+S)
5. The script is now active on all sites

Usage

1. Navigate to the Lovable-built site you want to audit
2. The script starts automatically and waits for a Supabase request
3. Log in to the site — this triggers Supabase API calls
4. The script will automatically intercept keys, scan for tables, and download a ZIP if any data is accessible
5. Check the DevTools Console for progress and results

Output

• File: <domain><timestamp>.zip
• Contents: One JSON file per accessible table with all records

---

Interpreting Results

Result	Meaning
ZIP file downloaded with data	Tables are exposed — your app is leaking data. Action required.
No data found / empty scan	No exposed tables were detected by this scan (see note below).
401/403 errors on tables	Access is denied — the table is protected. This is the expected secure state.

Important: A clean scan does not guarantee your app is fully secure. These tools only check for publicly accessible tables using known patterns and common table names. There may be additional tables, endpoints, or attack vectors that these scripts do not cover. Always perform a comprehensive security review and follow your platform's security best practices — do not rely solely on these tools.

How to Fix Exposed Tables

For Lovable / Supabase apps:

• Enable Row Level Security (RLS) on all tables in your Supabase dashboard
• Define proper RLS policies that restrict access based on user authentication
• Avoid using the service_role key in client-side code
• Review the Supabase RLS documentation

For Base44 apps:

• Review and configure entity permissions for each table
• Ensure sensitive entities are not publicly readable
• Use role-based access controls where available

Disclaimer

These tools are intended for authorized security testing only. Use them exclusively on applications that you own or have explicit permission to test. Unauthorized access to computer systems is illegal. The authors are not responsible for any misuse of these tools.

License

MIT