Incident response check
Start hereFor the day something has already gone wrong.
$790
Report in 24 hours
- Same-day start
- What is reachable right now
- Containment steps in order
- Key rotation and revocation list
- Findings report and fixes
After something went wrong
A user says they can see someone else's data. A key showed up in a public place. The model API bill jumped overnight. Or the database is simply gone. You need three things quickly: what is reachable right now, what to switch off first, and a list of what to fix once the immediate exposure is closed.
Written for founders who built with an app builder.
What to check first, in this order
Ordered by what a stranger reaches first. Each links to a self-check you can do today and to what our test adds.
- 01CriticalService-role key shipped in the browser bundle
Anyone who opens the app can copy the key from the downloaded JavaScript and read, change or delete every row in every table.
- 02CriticalSecrets committed to the code repository
Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted.
- 03CriticalRow Level Security disabled on a table
Anyone with the project URL and the public anon key, both of which sit in the app's JavaScript, can read, edit or delete every row in the table.
- 04CriticalRecord ids accepted without an ownership check
Anyone who changes the id in a URL or request can read, edit or delete another customer's record.
- 05CriticalAdmin routes without any login check
A stranger who types /admin or /api/admin into the address bar can see or change everything the owner can.
- 06HighNo spend cap on model calls
A script can hit the route in a loop overnight and the bill lands on your card, or the provider pauses your account mid-day when its own cap trips and every user sees errors.
- 07HighNo backup that has ever been restored
When data is deleted or corrupted, whether by a bug, an agent or a person, there is either nothing to restore or a backup nobody has proven they can actually bring back.
- 08CriticalAI agent with production credentials
Anything the agent decides to run, or is tricked into running by text it reads, executes with the same power you have, including dropping tables or moving money.
- 09HighSessions that survive logout and password changes
Someone who once had a user's token, on a shared computer or through a leak, keeps access after the user logs out or changes their password.
What happens without checking
In July 2025 a coding agent deleted data from a production database during a declared code freeze; the vendor confirmed it and rolled out separate development and production databases (Jason Lemkin (SaaStr), 2025). The two checks that decide how bad such a day is: whether a backup exists and has been restored at least once, and whether any agent or script holds production credentials. Both are in the list below.
In July 2025 a Replit agent deleted data from a production database during a user-declared code freeze; Replit's CEO confirmed it, said backups allowed a restore, and announced automatic dev and production database separation.
- 2025-07-18 User's report on X
- 2025-07-20 Replit CEO confirmation on X
Jul 2025 · Jason Lemkin (SaaStr) · all sources
Moltbook, a social network for AI agents built with AI-generated code, ran a Supabase database without row-level security policies, leaving 1.5 million API tokens and 35,000 email addresses readable and writable without login.
- 1.5 million API authentication tokens exposed
- 35,000 Email addresses exposed
- about 17,000 Human account owners in database
- 2026-01-31 Reported to maintainer
- 2026-01-31 (within about 2 hours) First fix applied
Feb 2026 · Wiz Research · all sources
Which package
Security sweep
For anyone who wants the three riskiest areas checked fast.
$290
Report in 24 hours
- API keys and secrets in the bundle
- Row-level rules on every table
- Cross-user data reads
- Admin and hidden routes
- Client-only permission checks
Compare all packages, or run the self-check first.
Questions
someone reported a vulnerability in my app
Thank them and ask for the exact steps. Rotate any key they mention. Check whether the same issue exists on similar tables or routes. Fix, re-test, and tell them it is fixed. If you want the assessment and containment order done for you within 24 hours, that is the incident response check.
my api key was leaked what should i do
Rotate it in the provider's dashboard now, redeploy so nothing still uses the old one, then read the usage and logs for the period it was exposed. If it was a database secret key, treat every row the app can reach as potentially read and check the tables for changes.
how do i recover a deleted database
Check your provider's backups first: Supabase has daily backups on paid plans and point-in-time recovery as an add-on, Replit documents checkpoint rollback and restore. Restore to a copy, not over production, then compare. After recovery, test a restore on a schedule so the next time is routine.
Other moments: before you launch, before you take payments, before an investor or security review, before a client handover, you received a security email.