Free security scanning for a Next.js + Supabase repo (no card)
GuardLayer is free for public Next.js + Supabase repos: every push is checked against the full set of stack-specific rules, with results posted as a pull-request comment and a pass/fail check, no credit card and no trial that expires. Private repos are scanned continuously from $19/month, and one-off uploads to the scanner are free for any code, public or private.
Here's exactly what's free, where free stops, and how to turn it on.
Most "free" security tools are a 14-day countdown or a crippled demo that flags three issues and hides the rest behind a paywall. GuardLayer's free tier is different in a specific way: it's the full engine, on as many public repos as you like, indefinitely. The paid plans are for watching private repos — not for unlocking the part that actually protects you.
What do you actually get for free?
Two separate things, and you can use either without paying:
A one-off scanner for any code, no signup. Upload files or paste a snippet at the scanner and you get a full report — every finding, the offending line, and the exact fix — in a few seconds. It makes no difference whether the code comes from a public or a private repo. No account, no card, nothing to install. Your raw files aren't kept: only the report is saved, with a short snippet of each flagged line, and it's reachable only through its unguessable link.
Continuous scanning on public repos. Connect GitHub, turn on the public repositories you want watched, and GuardLayer scans every push automatically. There's no cap on how many. You get a comment on the pull request and a pass/fail Check Run. It runs every Next.js + Supabase check — the same engine that's on every tier, not a trimmed-down free version.
The free tier isn't a trial. There's no countdown and no card on file: public repos, free, indefinitely.
Does the free check block a bad merge?
Only once you tell GitHub to use it. GuardLayer posts a failing check when something critical lands, but GitHub decides whether that stops the merge. Add GuardLayer as a required status check in the repo's branch protection settings and a failing scan blocks the merge. Without that, the check is advisory: you still see the result on the PR, but nothing is blocked. GitHub offers branch protection on public repos on every GitHub plan, so the merge gate works on GuardLayer's free tier too.
Is a free scanner actually useful, or just a teaser?
The honest test of a free tier is whether it catches the bugs that matter. GuardLayer's does, because the free plan runs the same rules as the paid ones — what you pay for is whether the repo is private, not how deeply it looks.
The two bugs most likely to end a Next.js + Supabase project are a service_role key that reaches the browser — it bypasses every RLS policy — and Row Level Security left disabled, which turns your table into a public API. Both are caught on the free tier, on every push. Here's the real engine flagging the first one, live on this page:
- Criticallib/supabaseAdmin.ts:7
Service role key exposed to the client
Never prefix the service role key with NEXT_PUBLIC_. Read it only in server code via process.env.SUPABASE_SERVICE_ROLE_KEY, and rotate the key immediately since it has been exposed. - Criticallib/supabaseAdmin.ts:7
Service role key used in client-side code
Move all service-role usage into a server context (Route Handler, Server Action, or server-only module). On the client use only the anon key, protected by RLS. - Criticallib/supabaseAdmin.ts:7
Secret exposed through NEXT_PUBLIC_
Drop the NEXT_PUBLIC_ prefix and read the value only on the server. Publishable/anon keys are fine to expose; secret keys, tokens, and passwords are not — rotate any that have shipped.
That's not a screenshot or a mock-up — it's the actual GuardLayer engine running on the code sample above, the same output you'd get on a pull request. The free scanner produces exactly this.
Where does free stop?
At private repos. Every plan gets the full engine — push scanning, PR comments, the pass/fail check, every rule, and the concrete fix. The main thing that changes is which repos GuardLayer watches on every push:
- Free — unlimited public repos. Full automation on every public repository you turn on, no card.
- Minimum — $19/month, up to 5 private repos. For when the product you're building lives in a private repo.
- Studio — $49/month, unlimited private repos, plus team access and an audit log.
Public repos stay free on every plan, so the paid limits only count private repos. You upgrade to have private code watched on every push, or to bring your team in — never to make the scanner work properly. Paid plans are a flat monthly price, not per developer, which usually beats a per-seat tool if you run several small apps; we walk through the math in the buyer's guide for solo devs.
How do I scan my Supabase app for free right now?
Pick the path that matches your repo:
- Instant, no account, any code: go to the scanner, drop in the files you're about to push — or your
lib/,app/api/, and migrations — and read the report. Best for a quick "where do I stand right now," and it's the free route for private code. - Continuous, on a public repo: sign in, connect GitHub, and turn on the repository. From then on every push is scanned and every risky PR gets a comment before it merges. Best for "I don't want to remember to check."
- Continuous, on a private repo: the same setup as step 2, on Minimum or Studio. To make the check block merges on a private repo, GitHub requires one of its paid plans (Pro, Team or Enterprise) for branch protection; on GitHub Free the check is advisory.
Every path shows the same findings GuardLayer posts on a pull request. Worst case, you confirm you're clean. Best case, you catch a service_role leak before a bot does.
FAQ
Is GuardLayer free? Yes, for public repos: continuous scanning on every push, on as many public repos as you like, with no credit card and no expiry. The one-off scanner is free for any code, public or private, and needs no account. Continuous scanning of private repos starts at $19/month.
Can I scan a private repo for free? One-off, yes. Upload the files at the scanner and you get the full report. The files are discarded after the scan; only the report is saved, with a short snippet of each flagged line, reachable only through its unguessable link. Having GuardLayer watch a private repo on every push needs a paid plan: Minimum ($19/month) covers 5 private repos, and Studio ($49/month) is unlimited.
Does the free plan expire or need a card? No. Public repos are free with no card on file and no trial countdown. You only enter payment details if you choose to upgrade.
What's included in the free plan? The full engine: scanning on every push, a pull-request comment, a pass/fail Check Run, every Next.js + Supabase check, the exact fix for each finding, and a downloadable PDF report. The Check Run blocks a merge only once you make it a required status check in branch protection. The paid plans add private repos (and, on Studio, team access plus an audit log) — not extra detection.
How many repos can I scan for free? As many public repos as you want, continuously. Private repos are what the paid plans count: Minimum watches up to five, and Studio is unlimited. The one-off scanner has no repo concept — you can scan any code without an account.
Do I need to sign up to try it? No. The one-off scanner runs without an account. You only sign in when you want continuous scanning tied to a GitHub repo.
Catch this before it ships — free
Scan your files for this and 35 other Next.js + Supabase issues, with the exact fix inline. Connect GitHub and GuardLayer checks every push too — free on public repos.
No signup, no card. Raw files aren’t kept; only the report is saved.