Request early access

The roster · 13 Ravens · 3 leads

Every power is a real check.

Secure Raven runs 13 checks called Ravens. Each one is a hero built on one of three bodies, and its power is exactly what that check does today. Hover, tap or focus a Raven to put it on alert.

Sentinel, perched, side view, on alert
SentinelRuns Watch
Warden, wings spread, facing you, on alert
WardenLeads the Database Ravens
Scout, in flight, side view, on alert
ScoutLeads the Web Ravens

Database Ravens · 7

Led by the Warden.

Warden body · wings spread, facing you · ice cyan #7FE6FF

Leads the Database Ravens, which read your policies, grants and settings and report names, flags and counts, never rows.

RLS Auditor, Storage, Auth, Secrets and Postgres Posture inspect how your Supabase or Postgres database is set up. Then Detector promotes the high and critical events to findings, each with its severity.

HIPAA Hawk is built on the same body. It maps safeguards to Security Rule citations and is not a certification.

  • Detector

    Promotes high and critical events to findings.

    Reports
    A finding for each high or critical event it promotes, named by its event type.
    Signature
    Alarm amber #FFB547
    Gear
    Alarm crest; the eye flares when it promotes a finding
    Sample findingSample

    High[HIGH] supabase.rls.disabled

    public.members

  • RLS Auditor

    Finds permissive read/write policies and disabled row-level security.

    Reports
    Table and policy names with a severity, derived from your policies. Never your rows.
    Signature
    Lock green #3BDF8F
    Gear
    Shield-lock chest plate, grid visor
    Sample findingSample

    CriticalPermissive write policy (USING/WITH CHECK true)

    public.invoices · invoices_write

  • Storage

    Finds public buckets and anonymous public write.

    Reports
    Bucket names, and whether anyone can read them or write to them.
    Signature
    Vault steel #9FB6CF
    Gear
    Vault-door wing plates
    Sample findingSample

    HighPublic storage bucket

    storage.exports

  • Auth

    Checks MFA coverage on connected Supabase projects.

    Reports
    MFA coverage on the project, as counts. Never user rows.
    Signature
    Factor gold #F2D04A
    Gear
    Keypad gauntlet, layered visor
    Sample findingSample

    HighMFA coverage below HIPAA authentication baseline

    Auth settings

  • Secrets

    Finds plaintext secret column names (names only, never values) and public anon-key leaks paired with weak RLS.

    Reports
    Column names that look like secrets. Names only, never values.
    Signature
    Cipher lime #B4EE4F
    Gear
    Masked visor, key insignia
    Sample findingSample

    HighPlaintext secret or credential column

    public.settings.smtp_password

  • Postgres Posture

    Checks for an end-of-life Postgres major version, extension updates and insecure settings (SSL, password_encryption, row_security).

    Reports
    The Postgres major version, extension versions and the names of insecure settings.
    Signature
    Elephant blue #5E8BFF
    Gear
    Heavy armour, version-ring gauge
    Sample findingSample

    HighInsecure PostgreSQL setting

    password_encryption = md5

  • HIPAA Hawk

    Maps technical-safeguard gaps to HIPAA Security Rule citations and tracks vendor BAA inventory gaps. Not a certification.

    Reports
    Each gap with the HIPAA Security Rule section it cites, and gaps in your vendor BAA inventory.
    Signature
    Clinical cyan #43C9F6
    Gear
    Citation tablet, medical-blue inlays
    Sample findingSample

    HighVendor may handle ePHI without a current signed BAA

    BAA inventory · cites 45 CFR 164.314(a)(1)

Web Ravens · 3

Led by the Scout.

Scout body · in flight, side view · ice cyan #7FE6FF

Leads the Web Ravens that check your public websites from the outside.

Web Headers, Web Surface and Login Flow check the security headers on your URL, exposed files and keys left in JavaScript bundles, and your login page and its cookies.

The Scout looks from the outside, like a visitor would. It is not a proxy and never sits in your traffic path.

  • Web Headers

    Checks CSP, HSTS, X-Frame-Options and Permissions-Policy on your URL.

    Reports
    Which security headers are missing or weak on your URL.
    Signature
    Header white #F4F7FB
    Gear
    Helmet crest made of header bars
    Sample findingSample

    HighMissing Strict-Transport-Security header

    https://www.example.com

  • Web Surface

    Finds exposed files and JS bundles that leak keys (Supabase anon/service_role, Stripe, AWS, GitHub and others).

    Reports
    The exposed path, or the bundle and the kind of key it leaks, with a redacted preview.
    Signature
    Lens teal #2CE5C3
    Gear
    Sweeping lens wing, bundle shards
    Sample findingSample

    CriticalExposed .env file

    https://www.example.com/.env

  • Login Flow

    Passive inspection of your login page and cookies.

    Reports
    Cookie names and the flags they are missing, from a passive look at your login page.
    Signature
    Cookie bronze #DB9F63
    Gear
    Cookie-seal talon, door silhouette
    Sample findingSample

    HighCookie 'session' missing HttpOnly flag

    https://www.example.com/login

Network and Watch Ravens · 3

Led by the Sentinel.

Sentinel body · perched, side view · ice cyan #7FE6FF

Runs Watch, a scheduled safe inspection every 6 hours by default, and leads the network Ravens.

Network Telemetry and Wi-Fi Telemetry read telemetry from a probe you run. Shield Verify records Shield verification in scan history.

Watch is not a firewall, and it is not 24/7 monitoring.

  • Network Telemetry

    Analyses telemetry from a probe you run for rogue devices, dangerous open ports and unauthorized hosts. It does not discover your network itself.

    Reports
    Unknown devices and dangerous open ports, from the telemetry your probe sends.
    Signature
    Port green #9BE86A
    Gear
    Antenna hackles, port-grid perch
    Sample findingSample

    High[PORTS] Dangerous ports on 10.0.4.12: 23, 3389

    Probe telemetry

  • Wi-Fi Telemetry

    Analyses probe telemetry for insecure access points, evil twins and WEP or open networks. Not active radio scanning.

    Reports
    Open or weak networks and suspected evil twins, from the telemetry your probe sends.
    Signature
    Wave sky #7DB4FF
    Gear
    Wave-ring eye, signal arcs
    Sample findingSample

    Critical[CRITICAL] Evil Twin suspected: "office-wifi"

    Probe telemetry

  • Shield Verify

    Records Shield verification in scan history. It does not claim enforcement by itself.

    Reports
    A Shield verification entry in Scan history. It never claims enforcement by itself.
    Signature
    Seal silver #C9D4E2
    Gear
    Seal stamp, verification tick
    Sample findingSample

    RecordedShield verification recorded. Effective status monitoring. Not a Protected claim.

    Scan history

Next

See them work in order.

Connect, then Static posture, then Detector. A stage that cannot finish is reported as incomplete, never as a pass.

How an inspection works Request early access
  1. Stage 01: ConnectThe probe must answer before anything is judged.
  2. Stage 02: Static postureFive Ravens read how your database is set up.
  3. Stage 03: DetectorHigh and critical events become findings.