Free leak report

One-time check of one app. Your keys are used for this single request and never stored. Results appear below and disappear when you close the tab.

1 · Stripe restricted key (read-only)

Open Stripe Dashboard → Developers → API keys (use the same mode — Live or Test — your app charges in).
Click “Create restricted key”. Choose “Providing this key to another website”, name it PaidCheck.
Set these to Read: Customers, Subscriptions (under Billing), Charges, Events, Webhook Endpoints. Leave EVERYTHING else at None.
Create the key, copy it (starts with rk_live_ or rk_test_) and paste it here. You can roll/delete it in Stripe at any time.

Restricted key rk_live_… or rk_test_… — full sk_live_ keys are refused

2 · Who has access in your app

Pick one. Paste the prompt into Lovable, Bolt, Cursor or Claude Code — it adds a read-only feed of just email, plan, active.

Your PaidCheck secret generated in your browser — it's already inside the prompt

Prompt to paste

Add a read-only "billing access feed" for PaidCheck to my Supabase project. Do NOT change any existing tables, policies or app behavior.

Create one SQL migration that:
1. Creates schema `paidcheck` (not exposed via the API).
2. Creates view `paidcheck.access_v` with EXACTLY three columns: `email` (lowercased user email, from auth.users), `plan` (text: the plan/tier my app thinks the user is on, or null) and `active` (boolean: true if my app currently gives this user paid access). Look at my schema to find where plan / subscription status / paid access is stored (e.g. profiles.plan, subscriptions.status, profiles.is_pro) and use that. Include every user who has an email.
3. Revokes all privileges on that view from anon, authenticated and public.
4. Creates table `paidcheck.config(secret_hash text not null)`, revokes all privileges on it from anon/authenticated/public, and inserts encode(extensions.digest('', 'sha256'), 'hex').
5. Creates function `public.paidcheck_access(secret text) returns table(email text, plan text, active boolean)`, LANGUAGE plpgsql, SECURITY DEFINER, STABLE, `SET search_path = ''`. It must raise an exception (errcode 42501) unless encode(extensions.digest(secret,'sha256'),'hex') matches a row in paidcheck.config, and otherwise `return query select v.email, v.plan, v.active from paidcheck.access_v v`.
6. `revoke all on function public.paidcheck_access(text) from public;` then `grant execute on function public.paidcheck_access(text) to anon;`
Make sure the pgcrypto extension is enabled (schema extensions).

After applying it, test it: calling the RPC with a wrong secret must fail; with the right secret it returns only email, plan, active. Then tell me my Supabase project URL and the anon/publishable key so I can paste them into PaidCheck.

Supabase project URLAnon / publishable key NOT the service_role / secret key — the function above is what limits access

3 · Email me the results (optional)

EmailEmail me a summary of this report and occasional PaidCheck updates. Optional, unsubscribe anytime.

Sent separately from your keys and never stored with them. The summary has totals and issue counts only, no customer emails.

By running a report you agree to the Terms and Privacy Policy. Keys are used once and not stored.