Security
Last updated: June 2026
DBAudit assesses Supabase and Firebase backend security. This page describes how the product handles scan inputs and reports, and how to reach us with security concerns.
1. Your data
DBAudit mostly uses information that is already visible to normal visitors or someone checking exposed backend endpoints.
For Supabase scans, we ask for specific schema details because Supabase no longer exposes the old anonymous REST discovery endpoints. The schema details describe structure, not table data.
When you submit a scan, temporary scan input data is encrypted at rest with AES-256-GCM before it is used for the scan - the plaintext is never persisted. This includes schema-only exports, anon keys, public Firebase web config values, and any optional dedicated test account login you provide. Test account login details are not saved for reuse; you enter them again each time you run or schedule a scan. As soon as the job completes or fails, the encrypted payload is deleted. We keep scan metadata and report data so your dashboard history can work.
Error messages produced during a scan are cleaned before storage to remove sensitive values that could appear in technical output.
2. Data isolation
Every report request is checked against your server-side session. A job or report ID alone is not enough to read or change anything; it also has to belong to your account.
3. Service providers
DBAudit uses a small set of third-party providers to operate the service:
- Cloud hosting: production application and database infrastructure.
- Transactional email: account verification, auth, and contact delivery.
- Bot protection: signup spam prevention.
- Payment processing: billing and subscription management.
The full sub-processor list with provider names is available in our Privacy Policy.
4. Current limits
- We are not SOC 2 certified or audited by a third party at this time.
- Data residency guarantees are subject to our infrastructure provider's region configuration, which we do not publish a specific commitment on.
- We are not a HIPAA business associate.
5. Responsible disclosure
If you find a security issue in DBAudit, please report it through our contact page or directly to our support address. Include a description of the issue, the steps to reproduce, and the potential impact. Please coordinate with us before any testing that could disrupt production systems.
We will acknowledge valid reports and work to address confirmed issues. We do not currently operate a formal bug bounty program.