Sample report · made-up app

Can strangers read your app’s data tables? Get a yes or no for every table.

Tablewatch looks at your published app from outside, every week and after each publish, and shows you in plain words when a table opens up. Planned price: $12 a month per app address. Not on sale yet. Email alerts are not yet available: you open your own report link. The sample below shows what the report looks like.

Check my own app Free to try now. No password asked.

Sample report. The app, tables and dates are invented. It is not a result for any real app.

Tablewatch reportMon 9 Nov, 9:02 am

1 table in sunrise-bakery.example can be read by anyone

Hi. Your last publish was on Sunday. We just checked sunrise-bakery.example from outside, signed out, the way any visitor would. One table answered when it should not have.

Could a stranger read this table without logging in?
Table	Answer
customers	YES, openAnyone can ask for it.
orders	No, closed
order_notes	No, closed
bookings	No, closed
menu_items	No, closed

How to close `customers`

Easiest: tell your app builder this, then publish again.

“Turn on row level security for the customers table, so a signed-in person can only see their own rows. Then publish.”

Then press I published on your Tablewatch page. We check again straight away and show you the new answer.

We only recorded yes or no for each table. We never read or kept any rows. This report was written by software from a fixed template. It checks one thing, whether tables answer without login, and does not make an app safe on its own.

What the report shows over time

Every week · sampleAll 5 tables in sunrise-bakery.example are closedA short all-clear on your report, so a quiet week means no news, not a broken check.
Right after you press I published · sampleFixed: customers is now closedThe new answer for every table, a few seconds after you press.

Email alerts are not yet available. Keep your private report link and open it any time.

Why weekly matters

A table can be closed one week and open after a publish. Sample history, 6 weekly checks:

0open5 Oct
0open12 Oct
0open19 Oct
0open26 Oct
0open2 Nov
1open9 Nov

Check your own app

Works for apps built with Lovable, Bolt, Replit or Base44 that use Supabase. We only check addresses you prove are yours.

Not on sale yet

The standing watch

$12 a month, for one app address

Check every week, plus after each I published
Plain-words answer, with the fix to say to your builder
Email alerts: planned, not yet available

Today the check is free to try. Nothing is charged.

What Tablewatch touches, and what it never does

What it does

Opens your public app address like any visitor.
Asks, signed out, whether each table answers.
Keeps the table names and a yes or no for each, so your report can show them.

What it never does

Never reads or keeps your rows, customers or orders.
Never asks for a password, a service key or your builder login.
Never checks an address you have not proved is yours.

What it cannot tell you

It checks one thing: tables that answer without login. It does not find every problem, and a clean report does not mean the app is safe. A table with no rows in it looks closed.

Checks and report text are automated. A person reads replies.