GuardLayer scans every push for the security holes that actually get startups hacked — exposed keys, missing RLS, unprotected Server Actions — and hands you the exact fix. Not another wall of warnings. The patch.
Shipped something Lovable, Cursor, or v0 built? Those are exactly the bugs it catches — before they reach production.
No credit card. No config. Free forever for one repo, then $19/mo.
This Server Action writes to posts with no auth check — any visitor can call it.
const user = await requireUser();
if (!user) throw new Error("Unauthorized");// the boring truth
Not zero-days. The kind of thing a developer could have fixed in an hour, if anyone had the time to look:
Enterprise tools like Snyk cost $100+/mo and take a day to configure. GuardLayer takes two minutes, then runs itself.
// how it works
Every push moves through the same four steps — and on the right is exactly what it flagged on the last one.
Nothing changes in your workflow. Or upload files right here.
Against your whole codebase, not just the changed lines. Takes seconds.
Not “RLS missing” — the precise SQL to run.
Make GuardLayer a required check in branch protection and a failing scan blocks the merge — so no leaked key ships by accident.
27 checks · 14 files · 0.4s
✗ 2 critical — check failed · fix attached to each
// from founder interviews
Exactly the thing I didn’t know I needed. We had an RLS miss in production last quarter that cost us a week. $20–30 is nothing — cheaper than an hour of my time.
Finally something that doesn’t assume you have a dedicated secops person. We’re three people and none of us is a security expert. Two minutes and it runs itself — no-brainer.
A service role key that ended up in a public repo cost us two days. $20–30 a month is nothing if it prevents a single breach. It fixes the problem, not just identifies it.
// pricing
Per project, not per seat — your whole team for one flat price, while the enterprise tools start at $100+/mo and a day of setup.
Secure your first project — no card required.
One indie, one product, shipping fast.
// straight answers
GuardLayer is a security scanner for Next.js + Supabase apps. It runs 27 static checks on every push — exposed keys, missing Row Level Security, unprotected Server Actions, unvalidated API routes, and secrets in config — gives you the exact fix inline, and posts a pass/fail check on the pull request.
For that specific stack, a specialised scanner beats a generic one on precision. GuardLayer is built only for Next.js + Supabase, so it catches framework footguns — disabled RLS, a service_role key in the browser, a missing Server Action auth check — that broad tools like Snyk or GitGuardian aren’t designed to find. Most teams run it alongside a secrets scanner and a dependency scanner, not instead of one.
Both — depending on one setting you control. GuardLayer scans every push and PR and posts a pass/fail check, a PR comment, and a full report. To make a failing check actually stop a merge, add GuardLayer as a required status check in your branch protection (GitHub includes this on public repos and paid plans; it takes about a minute). With that on, a critical greys out the merge button. Without it, GuardLayer runs in advisory mode — you still get the scan, score, and ❌/✅, it just won’t hard-stop the merge. One honest limit: like every GitHub app, GuardLayer can’t reject a raw “git push” — it gates the merge, which is where un-reviewed code actually reaches your main branch.
That’s the whole design constraint. GuardLayer runs a deliberately tight rule set and is tuned to stay quiet on safe, idiomatic code — public anon keys, parameterised SQL, properly-guarded actions. If it can’t show you the exact line and the fix, it stays quiet.
That’s the moat. A generic scanner can’t match the precision of a tool built for one stack. Being the best for Next.js + Supabase matters more than being okay for everyone.
Yes — upload files here, or connect a repo. No config files, no security dashboard to learn. Try the live demo above and see a real report in seconds.
They secure their platform. Application-level security — your RLS policies, your Server Actions, your keys — is still your responsibility. Supabase protects Supabase. We protect your app.
Yes — once every 30 days. The free plan watches one repo continuously (every push, PR comments, the full check set); you can switch which one about once a month. That keeps the free tier genuinely useful without it quietly replacing a paid plan. Need several repos watched at once? Minimum ($19/mo) covers 5.
// ship it