Perimeter early-warning for apps built with AI
Watch the front door. $19 a month.
RLS Radar’s core plan is a perimeter early-warning. Each week it repeats a passive, GET-only scan of a site you own and emails you when the outside view changes. A newly exposed file, a security header that disappeared, or a secret that landed in the JavaScript. Paid plans also grade the code when you connect a repository. The perimeter score says how tidy the front door looks. It does not test logins, authorization, or whether one customer can read another’s data.
The first perimeter scan on a verified domain is free. A one-time $9 scan is there if you want a single paid look, including the code grade, before you subscribe.
- Ownership required
- GET requests only
- No customer rows stored
- Not a pentest
An environment file is publicly downloadable
A public .env file is how secret keys, database URLs, and private configuration end up on the open web. Even if the values look like tests, assume they are live until you have rotated them.
Anthropic secret key is in files the browser can download
Anyone who can load the site can copy this Anthropic secret key and use it from their own machine. Treat it as public. Rotate it, then remove it from client code.
OpenAI secret key is in files the browser can download
Anyone who can load the site can copy this OpenAI secret key and use it from their own machine. Treat it as public. Rotate it, then remove it from client code.
From the built-in sample app, not a customer.
1. Prove it’s yours
Add a DNS TXT record, or a file at /.well-known/rlsradar-verify.txt. Unverified domains are not scanned.
2. Free first look
One perimeter scan per verified domain and per email. It does not read your repository.
3. $19/month, or $9 once
Monitoring repeats the perimeter scan each week and emails you when it changes. Both paid options add the code grade when a GitHub repo or a zip is connected.
What the full scan looks for
Secrets in the browser
OpenAI, Anthropic, Stripe secret keys, AWS access key ids, Supabase service_role and sb_secret keys, GitHub tokens, private keys. Supabase anon keys and Firebase web keys are called out as public by design.
Open Supabase tables
If the page contains a project URL and an anon key, we GET the OpenAPI schema and try a read-only select with limit 1. We store table names and whether any row came back, not the rows.
Open Firebase data
If the page contains a Firebase config, we try an unauthenticated read of the Realtime Database root and a one-page Firestore list.
Files that should not be public
.env, .git/config, SQL dumps, and JavaScript source maps.
Security headers
CSP, HSTS, nosniff, framing, referrer policy, permissions policy. Missing headers are lower severity than an open database.
Admin routes with no login
GET /api/admin, /api/seed, /api/debug, and a few similar paths. A 200 with a data body is a finding. The HTML app shell is only a note.
Code, on a paid scan
Committed secrets, env files missing from .gitignore, service-role keys in the client bundle, npm audit, and SQL that creates a table without row level security or a policy of using (true). The result is a letter grade, not a second perimeter score.
What we will not do
- Scan a domain you have not verified.
- Send anything but GET, or try SQL injection, XSS, or auth bypass.
- Use a service_role key if we find one. Finding it is the whole point.
- Store dumped rows, secret values, or source-map contents.
- Call the result a penetration test or a guarantee.
Don’t uninstall PostGIS
This product exists because a Supabase security advisor warning looked like a leak and was not one. PostGIS catalogs such as spatial_ref_sys, and views that are SECURITY DEFINER on purpose, show up in the report as likely false positives or accepted risks, with an explanation. The goal is a report you can act on, not a page of red badges.
Core plan
$19/month
Perimeter early-warning plus the code grade.
Weekly rescans of one verified project, a changed-since section, and an email when a new file is exposed, a header drops off, or a new secret shows up. Connect GitHub or upload a zip and the same plan grades the code. Checkout waits on ENABLE_MONITOR, so this does not charge anyone until that is set.
One-off
$9
One paid scan, in US dollars.
The perimeter pack, the code grade when a repo is connected, an emailed report, and a fix prompt. Use it once, then move to monitoring if you want the weekly diffs.
Free
$0
First perimeter scan on a verified domain.
One free scan per domain and per email, while the daily cap has room. It does not read a repository and it does not include the code grade.