FOR FREELANCERS AND AGENCIES ON SUPABASE + VERCEL

Nightly rounds for every client app you maintain.

Tendrounds checks each client's Supabase and Vercel app every night for exposed keys, open tables and RLS gaps. It backs up the database off-site and restores the backup every week to prove it works. On the 1st, you get a report with your logo to send the client.

Scan one app free Join the agency waitlist

Read-only. Owner-verified. No signup to run your first scan.

Northbeam Studio

Last round 02:00 CT · 8 of 8 apps checked

2 fail · 1 watch · 5 pass

StatusClient · appLast 30 nights

Fail
Acme Dentalbooking.acmedental.com
SB-RLS-003public.patients readable with anon key (1,204 rows)
Watch
Kettle & Cokettle-orders
WEB-TLS-001certificate expires in 9 days
Pass
Riverside Gymmembers.riversidegym.co
Restore test passed Sun 03:10, 41/41 tables
Pass
Lumen Legalintake.lumenlegal.com
30/30 nights clean
Fail
Fernwayfernway-crm
SB-KEY-001service_role key in /_next/static/chunks/app-4f2a.js
Pass
… 3 more apps, all clean

Example workspace. Your apps, your data.

01 / Why

You shipped it in a weekend. Now you're on call for it forever.

Lovable, Bolt and Cursor made building client apps fast. Nobody made maintaining them fast. Every app you hand over has a Supabase project with RLS you wrote in a hurry, an anon key in the bundle, and a database nobody has backed up anywhere you control.

Multiply that by eight clients and “maintenance” means opening eight dashboards, a spreadsheet, a GitHub Action you're not sure still runs, and hoping.

1 in 9
“We scanned 20,000 indie apps; 1 in 9 leaked their database keys.”
Community scan, r/Supabase · source (opens Reddit in a new tab)
394 of 30,998
Live vibe-coded apps that “had a users table anyone could read.”
Community scan, r/vibecoding · source (opens Reddit in a new tab)
0 backups
What the Supabase free tier includes, according to users rolling their own GitHub Actions + R2 setups.
Thread, r/Supabase · source (opens Reddit in a new tab)

Self-reported community scans of public apps, not Tendrounds data.

02 / Checks

Fourteen checks per app, every night. Here's every one.

No mystery score. Each check has an ID, reads one specific thing, and tells you the exact fix.

Database7

SB-RLS-001

RLS disabled on an exposed table

Reads Postgres catalog, via your read-only role

SB-RLS-002

Policies that are using (true) for anon or authenticated writes

Reads pg_policies

SB-RLS-003

Tables readable with your anon key

Reads Row counts via PostgREST. Never the rows.

SB-RLS-004

User emails or phones in an unprotected public table

Reads Column names + RLS state

SB-STO-001

Public storage buckets you didn't mean to make public

Reads Bucket settings

SB-ADV-000

Supabase's own security advisor errors

Reads Supabase Management API

SB-AUTH-001

Open sign-ups with email confirmation off

Reads Auth settings

Keys3

SB-KEY-001

service_role or sb_secret_ key shipped in your JS

Reads Your production bundle

SB-KEY-002

Stripe, OpenAI, AWS and other secrets in your JS

Reads Your production bundle

VC-ENV-001

Secret-looking env vars exposed to the browser (NEXT_PUBLIC_*SECRET*)

Reads Vercel env var names

Hosting3

VC-DEP-001

Failing production deployment

Reads Vercel deployments

WEB-TLS-001

Certificate expiring or invalid

Reads TLS handshake

WEB-DOM-001

Domain registration expiring

Reads RDAP

Backups1

BK-001

Backup older than 26h, or no passing restore in 8 days

Reads Our backup log

FailSB-RLS-003

public.patients is readable with the anon key

App: booking.acmedental.com · Acme Dental
Evidence: HEAD /rest/v1/patients → Content-Range: 0-0/1204
First seen: Oct 19, 02:00 CT
Fix

alter table public.patients enable row level security;
create policy "patients: owner can read"
  on public.patients for select
  to authenticated
  using ((select auth.uid()) = user_id);

Re-checked at tonight's 02:00 round

One finding, as it appears in the app.

03 / Backups

A backup counts once it's been restored.

Every night Tendrounds takes an off-site pg_dump of each client database, encrypts it with a key unique to your workspace, and stores it in a bucket with a retention lock, so it can't be deleted early, even by us. Every Sunday it restores the latest dump into a throwaway Postgres, checks every table and row count against what it backed up, and deletes the copy.

NIGHTLYOff-site dump + optional Storage sync
WEEKLYAutomated test restore with a table-by-table diff
ALWAYSEncrypted per workspace, retention-locked, downloadable by owners only

Restore logfernway-crm

Sun Oct 18 03:00 CT restore-test fernway-crm

backup: Oct 18 02:31 · 182 MB · sha256 9c1e…b07a
target: ephemeral postgres (deleted after test)
restored: 41 tables · 2m 14s
verified: 41/41 tables · row counts match · 20/20 sampled keys found
result: PASS

Restore tests verify your data is complete and recoverable in Postgres. Restoring into your Supabase project is a guided step we walk you through.

04 / Reports

On the 1st, a report your client can actually read.

Tendrounds drafts one report per client, with your logo, your colors and your sending domain. Plain English, one to three pages: what was checked, what was found, what you fixed, uptime, and the backup and restore log. Add a note about the work you did, then send. It's the proof behind your maintenance retainer.

NORTHBEAM STUDIO

Care report

Acme Dental · October 2026

31 nightly rounds · 31 backups · 4 restore tests, all passed · 99.96% uptime

Resolved this month

A patient table was readable without logging in. We enabled row-level security on Oct 19; the table is now private.

Open

Nothing open.

Uptime, Oct 1–31

Oct 1Oct 19 · 18 min degradedOct 31

Restore tests

Sun Oct 4	41/41 tables	Pass
Sun Oct 11	41/41 tables	Pass
Sun Oct 18	41/41 tables	Pass
Sun Oct 25	41/41 tables	Pass

Prepared by Northbeam Studio.

White-label on the Agency plan. Your client never sees our name.

05 / Setup

Connected tonight. Checked by morning.

1/3
Add a client app.
Paste the production URL. Connect Supabase with OAuth (read-only scopes) and Vercel with our integration.
2/3
Create a read-only database role.
Copy our short SQL snippet. It's Supabase's own documented recipe for a backup role. We test it and confirm it's read-only.
3/3
Sleep.
The first round runs within minutes, then every night at 02:00 your time. Alerts go to email and Slack. Reports arrive on the 1st.

06 / Free scan

Scan one app free. See what your anon key can see.

We check your production bundle for leaked keys, count which tables your public anon key can read, look for public storage buckets, and check your certificate and domain expiry. Read-only. Takes about a minute.

SB-KEY-001privileged Supabase key in your JS
SB-KEY-002third-party secrets in your JS
SB-RLS-003tables your anon key can count
SB-STO-001public storage buckets
WEB-TLS-001certificate expiry
WEB-DOM-001domain expiry

07 / Pricing

Priced so one client retainer covers it.

Free scan

One owner-verified scan per app
Keys, anon-readable tables, buckets, TLS, domain
Results by email

Scan an app

Solo

$49/mo

5 apps
All 14 nightly checks
Nightly backups + weekly restore tests
Email and Slack alerts
Monthly client report
1 seat · 14-day trial

Join waitlist

Trials open when billing ships.

Agency

$149/mo

25 apps
Everything in Solo
White-label reports: your logo, colors and sending domain, no Tendrounds credit
Bring your own backup bucket (S3 or R2)
Longer retention
5 seats

Join the agency waitlist

Founding agencies: the first 10 get the Agency plan at $29/mo for life. We'll ask for a 15-minute call and honest feedback in return.

For reference: RowShield (RLS monitoring) is $29/mo for 3 projects or $99/mo for 15. SupaSafe (backups) is $4.99–$19.99/mo. Both are good at one job for your own app. Tendrounds covers the whole care plan across your clients.

09 / Access

What we can see, and what we can't.

What Tendrounds can and can't access
We can	We can't
Read your Supabase project's settings, buckets and security advisor results (read-only OAuth scopes)	Change any Supabase setting. We don't request a single write scope.
Read your data through a role you create, for backups and policy checks	Write to your database. The role is read-only by default, and we only run an allowlisted set of queries.
Read Vercel project and deployment status, and env var names	Read env var values, deploy, or change anything in Vercel
Count rows your anon key exposes	Fetch those rows. We count them and stop.

Credentials are encrypted with AWS KMS. The web app can encrypt them but can't decrypt them; only the background worker can, at the moment it runs your round. Backups are encrypted per workspace and retention-locked. Every access is in your audit log. Found a security issue in Tendrounds? Email security@tendrounds.com.

Read the full access and security page →

10 / FAQ

Questions agencies ask first.

Is this a pen test?

No. Tendrounds does read-only configuration checks every night. It won't find logic bugs in your app code, and it never attacks anything.

Do I need a paid Supabase plan?

No. It works on free-tier projects, which is where backups matter most.

Where are backups stored?

In our Cloudflare R2 bucket, encrypted and retention-locked. On the Agency plan you can use your own S3 or R2 bucket instead.

Can my client see Tendrounds?

Only if you want them to. On the Agency plan, reports go out under your name and domain.

What if a check is wrong for my app?

Acknowledge it with a reason. It stays visible in the report as an accepted risk and stops alerting.

Netlify, Firebase, Neon?

Supabase + Vercel first, because that's where most AI-built client apps live. Tell us on the waitlist what you need next.

Can I scan a client's app before they sign?

Yes, with their permission and ownership verification. It's a good way to start the maintenance conversation.

Who's behind this?

KM, a solo founder who builds and runs apps on this exact stack, and runs Tendrounds on his own apps every night.

Tonight's round starts at 02:00.

Scan one app now, or get your studio on the founding list.