GuardLayer scans every push for the security holes that actually get startups hacked — exposed keys, missing RLS, unprotected Server Actions — and hands you the exact fix. Not another wall of warnings. The patch.
Shipped something Lovable, Cursor, or v0 built? Those are exactly the bugs it catches — before they reach production.
No credit card. No config. Uploading files is free for any code. Connected repos: free forever on public, private from $19/mo.
This Server Action writes to posts with no auth check — any visitor can call it.
const user = await requireUser();
if (!user) throw new Error("Unauthorized");// the boring truth
Not zero-days. The kind of thing a developer could have fixed in an hour, if anyone had the time to look:
Enterprise tools like Snyk cost $100+/mo and take a day to configure. GuardLayer takes two minutes, then runs itself.
// how it works
Every push moves through the same four steps — and on the right is exactly what it flagged on the last one.
Nothing changes in your workflow. Or upload files right here.
Against your whole codebase, not just the changed lines. Takes seconds.
Not “RLS missing” — the precise SQL to run.
Make GuardLayer a required check in branch protection and a failing scan blocks the merge — so no leaked key ships by accident.
36 checks · 14 files · 0.4s
✗ 2 critical — check failed · fix attached to each
// from founder interviews
Exactly the thing I didn’t know I needed. We had an RLS miss in production last quarter that cost us a week. $20–30 is nothing — cheaper than an hour of my time.
Finally something that doesn’t assume you have a dedicated secops person. We’re three people and none of us is a security expert. Two minutes and it runs itself — no-brainer.
A service role key that ended up in a public repo cost us two days. $20–30 a month is nothing if it prevents a single breach. It fixes the problem, not just identifies it.
// pricing
Free for public repos. Flat monthly tiers for private ones, not per seat — while the enterprise tools start at $100+/mo and a day of setup.
Open source and public projects — free, forever.
One indie, one product, shipping fast.
// straight answers
GuardLayer is a security scanner for Next.js + Supabase apps. It runs 36 static checks on every push — exposed keys, missing Row Level Security, unprotected Server Actions, API routes that pass request input to dangerous sinks, and secrets in config — gives you the exact fix inline, and posts a pass/fail check on the pull request.
For that specific stack, a specialised scanner beats a generic one on precision. GuardLayer is built only for Next.js + Supabase, so it catches framework footguns — disabled RLS, a service_role key in the browser, a missing Server Action auth check — that broad tools like Snyk or GitGuardian aren’t designed to find. Most teams run it alongside a secrets scanner and a dependency scanner, not instead of one.
Both — depending on one setting you control. GuardLayer scans every push and PR and posts a pass/fail check, a PR comment, and a full report. To make a failing check actually stop a merge, add GuardLayer as a required status check in your branch protection (GitHub includes this on public repos and paid plans; it takes about a minute). With that on, a critical greys out the merge button. Without it, GuardLayer runs in advisory mode — you still get the scan, score, and the pass/fail check, it just won’t hard-stop the merge. One honest limit: like every GitHub app, GuardLayer can’t reject a raw “git push” — it gates the merge, which is where un-reviewed code actually reaches your main branch.
That’s the whole design constraint. GuardLayer runs a deliberately tight rule set and is tuned to stay quiet on safe, idiomatic code — public anon keys, parameterised SQL, properly-guarded actions. If it can’t show you the exact line and the fix, it stays quiet.
That’s the moat. A generic scanner can’t match the precision of a tool built for one stack. Being the best for Next.js + Supabase matters more than being okay for everyone.
Yes — upload files here, or connect a repo. No config files, no security dashboard to learn. Try the live demo above and see a real report in seconds.
They secure their platform. Application-level security — your RLS policies, your Server Actions, your keys — is still your responsibility. Supabase protects Supabase. We protect your app.
Public repos are free: unlimited, every check, PR comments and the merge gate. Continuously scanning a private repo needs a paid plan — Minimum ($19/mo) covers 5, Studio ($49/mo) is unlimited. To make the check block merges on a private repo, GitHub needs one of its paid plans (Pro, Team or Enterprise) for branch protection. You can still scan private code free, one-off, by uploading files at /scan. Your raw files aren’t kept: the saved report holds the file paths, the findings and a short snippet of each flagged line, reachable only through its unguessable link.
// ship it
A Solvion project — see also Reglog — EU AI Act changelog, Proceedly, Solenna and Solvion Solutions.