RowAttest Pre-launch

Signed proof that strangers can't read your users' data.

RowAttest runs an eight-stage isolation test against your staging Supabase and issues a signed attestation anyone can verify.

We use your address only to contact you about early access.

Why this exists

The failure is systemic. It is also checkable.

  1. 01 · Incident

    A row-level-security failure across apps built with Lovable left 170+ apps and 303 endpoints open: personal debt records, home addresses and API keys, readable with two strings taken from the page source. Disclosed as CVE-2025-48757 on 2025-05-29.

    Source: Flowpatrol, “The Lovable RLS Leak: 170+ Apps, 303 Open Endpoints, and a Database You Could Query From the Browser”

  2. 02 · Pattern

    Not one careless developer. The same tool, the same template, the same missing line, across 170+ apps. A later scan of 380,000 apps built the same way turned the question from who slipped into how the pattern repeats.

    Discussion: r/vibecoding, “Researchers scanned 380,000 vibe-coded apps. Here's what they actually found.”

  3. 03 · Mirror

    You can't tell by reading policies. You find out by seeding an attacker in a second tenant, trying to reach the first tenant's rows, and keeping the evidence either way.

    That is the test. Below is what its result looks like on a sample app, signature included.

    See the sample report and verify it ↓

Sample attestation

What a report looks like, and how to check it hasn't been altered.

A sanitized excerpt for a fictional app. The signature underneath is real: your browser checks it against the demo public key. Edit the report and it stops verifying.

Sample · synthetic data RA-SAMPLE0001

RowAttest Attestation Report

RA-SAMPLE0001 · SAMPLE

Sample. Synthetic data throughout. “Tasklio” is a fictional demo application built by RowAttest to show the report format. Names and identifiers are placeholders; the signature in the block below is a real Ed25519 signature over this excerpt's canonical JSON, made with a demo key.

1 · Header

Project ref
tasklio-demo (fictional)
Environment
declared as staging by the customer
Run window (UTC)
2026-09-18 14:02:11 → 14:09:47
Engine
v0.1.0-sample
Issued by
RW Digital Ventures LLC (RowAttest)

2 · Executive summary

1 of 93 evaluated boundaries failed: a seeded attacker in one tenant could reach another tenant's data. Details in the findings section.

  • 92

    Pass

  • 1

    Fail

  • 12

    Not evaluated

  • 0

    Error

Coverage: 7 of 8 tables evaluated (84 cells) plus 1 storage bucket (9 cells); 1 table not evaluated (12 cells, unknown tenancy).

5 · Finding F-1 · cross-tenant UPDATE on tasks

What was accessed
A task row belonging to tenant A (synthetic row rowattest_synthetic_task_a1) was modified by a user in tenant B
As whom
Seeded user [email protected] (tenant B, role: member)
Reproduction
PATCH /rest/v1/tasks?id=eq.<synthetic-id> with tenant-B access token, header Prefer: return=representation; body {"title": "changed-by-b"}
Evidence
HTTP 200; response body contains the modified row (1 row returned, synthetic row only)
Detected by
Layer A (API) and Layer B (policy simulation), both agree
Fix direction
The UPDATE policy on tasks checks membership in USING but has no WITH CHECK, and the USING clause does not compare org_id. Add an org_id membership check to both clauses.

8 · Signature block

Report SHA-256 (canonical JSON)
0d0b8385f6fa968afaba9aa7e2ac396717d5605bfafea3d395aea76e0ccfbf97differs from the signed hash
Ed25519 signature
08bf197e72e038ed797cb60f39b593768abe8edeecac409ba7412ee935e6b60cd676dcf9609c0d355deedf92ba87fbe5a7b2d8935e6c224500d388108e8bc90b
Demo public key (Ed25519)
0a751ebe666571509fda8763a81bb54b74fcf333b3b86d61d0b2df47f3a086c5
Key fingerprint (SHA-256)
c7e4b86705e7ded0a2456f623345fb8c099eb95cdea3dfa6e760b206509e76a7

Production reports are signed with a separate key and carry a public verify link; no account is needed to check one. This sample is signed with a demo key, and you can check it right here.

Not yet verified

How it works

Three steps, one artifact.

  1. 01

    Connect a staging project

    Point RowAttest at a staging Supabase project you are authorized to test. Production is out of scope.

  2. 02

    The eight-stage engine runs

    It reads the security surface, infers the tenancy model, seeds its own attacker accounts, executes the cross-tenant matrix, keeps the evidence and tears everything down.

    • preflight
    • static-introspection
    • tenancy-inference
    • attacker-seeding
    • matrix-generation
    • execution
    • evidence-capture
    • teardown

  3. 03

    Signed attestation, public verify link

    The report is hashed and signed with Ed25519. Anyone you hand it to can check it without an account.

    • report-signing

Status

Where this stands.

Status
Pre-launch. RowAttest is not yet available. The waitlist is for the alpha.
Capacity
The alpha is limited to what one founder can serve.
Scope
Testing runs only against staging environments, with written authorization from the project owner.
This page
The report above is a sample for a fictional app. Nothing on this page is a customer result.

Get early access.

Leave an email and we'll contact you when an alpha slot opens.