Checks

Check	Severity	What it finds
supabase.rls.disabled	critical	A table exposed through Supabase with no row-level security.
supabase.rls.permissive_write	high / medium	A policy that lets anyone, or any signed-in user, change rows with a condition of true.
supabase.rls.public_read	medium	A table anyone can read in full.
credential.committed	critical	A password, token or service_role key committed to the repository.
frontend.secret_in_bundle	critical / high	A secret shipped to every visitor's browser.
platform.hardcoded_url	medium / low	Something that stops working when the app leaves the platform.
service.no_health_endpoint	low	A backend that nothing can ask "are you working?".

A key that is public by design, such as a Supabase anon or publishable key or a Firebase web API key, is never a finding. Its safety comes from the database rules, which is what the row-level-security checks look at.

If a check reports something that is wrong about your app, that is a bug: see accuracy.