What VibeSitter can access
When you connect a Supabase project, VibeSitter asks for read-only access. We can look at your settings and structure. We can never touch the things that matter.
What we can see
Your project's settings and configuration
Sign-up options, email confirmation, backup status. Read-only.
A read-only look at your database structure
Tables, security policies, and function permissions — through read-only Management API queries. Your data content is never read.
Your app's public pages
We fetch them like a normal visitor to check for leaked keys and broken pages.
What we never do
- Write to, change, or delete anything in your database
- Read the contents of your tables (data, files, PII)
- Store your access tokens in plain text
- Scan your users' data or payloads
Read-only scopes, nothing more
The read scopes we request are:
auth:read— your auth configurationdatabase:read— structure of tables, policies, and functionsprojects:read— project metadatarest:read— PostgREST API exposurestorage:read— which storage buckets existenvironment:read— branch information
No write scopes. Never. You can disconnect at any time. Deleting your account removes your projects, scans, and findings; we also honor data-deletion requests within 7 days.
Manage my connections