{
  "id": 9575871,
  "title": "BreachProbe finds database leaks in shipped apps",
  "url": "https://urgent.news/2026/09/24/breachprobe-finds-database-leaks-in-shipped-apps",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-24T15:34:47.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/compoundlabs/breachprobe-finds-database-leaks-in-shipped-apps-4oj7"
  },
  "original_language": "en",
  "account": "BreachProbe, a security scanning tool for shipped applications, has discovered database leaks in certain software packages. The tool can provide a clean result even when it cannot fully access the tested systems. Recently, a commit fixed this issue by implementing HMAC verification for Supabase JWT signing secrets and adding seven new cases to the deploy check. The BreachProbe scan console accepts a single app URL and operates in read-only mode, revealing the scan's checks in a specific order. The scan examines shipped JavaScript, probes Supabase REST endpoints, checks response headers, searches for broken-auth patterns, inspects Stripe routes, and establishes two signed-in test accounts for cross-tenant checks. The sample report generated by BreachProbe includes a scored application with a grade, severity totals, issue titles, evidence locations, and suggested fixes. The report addresses a critical finding of cross-tenant reads across three tables from two signed-in users. The report then proposes a policy change using auth.uid() and the affected owner column, followed by instructions to re-run the scan. The BreachProbe scan console presents 33 issue types and 32 written fixes, categorizing them into shipped-code checks, response-header checks, Supabase REST checks, signed-in-user checks, and Stripe-route checks. This organization helps users understand the source of each verdict. The method page explains the probing process, stating that JWT candidates are verified against the app's own public anon key rather than being reported solely based on their string shape. The signing-secret verifier recomputes the HS256 signature using a cryptographic hash function, ensuring the integrity of the verification process. When a scan fails, the scan bar displays four status terms: no account, nothing installed, read-only, and a single URL. In the case of an error, the error message appears on its own row beneath these terms. A recent commit altered this state after the error message displaced the status terms. Additionally, the demo destination was moved to the sample report, allowing the console's worked example to open directly from the scanner surface.",
  "summary": "breachprobe.thecompound.tech Security checks can return a clean result even when the check itself cannot reach what it tests. Commit 2a513f7 fixed that in BreachProbe by proving Supabase JWT signing secrets with HMAC verification and adding seven cases to the deploy check. BreachProbe The scan console The console accepts one app URL and labels the scan read-only. It shows that no account or…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}