Dated evidence on your Supabase stack. A skeptical reader can finish it. It is not a certification.
Kloof reads your Supabase schema and edge functions and produces dated evidence: verdict, ranked findings, remediation order. The scan finishes in minutes. The Report is a reviewed artifact, signed by a human who reads every High. It's not a pentest, and we won't pretend it is.
No production access · No service_role · Read-only repo or a zip · 5 business days
What Kloof is, and what it isn't
Most scanners overclaim. Kloof's value is that it doesn't. You get evidence you can stand behind, labeled by how much confidence it carries.
✓ What you get
- A named battery over your repo: Postgres/RLS, storage, every edge function's authorization, client-bundle secrets
- A reviewed PDF with verdict, scores, ranked findings, remediation order
- A human reads every High before it ships (minutes to run ≠ minutes onto your letterhead)
- Findings the RLS/edge-function layer breaks on. The stuff generic scanners miss.
- A precondition check for indirect prompt injection in edge functions that call an LLM (review-tier)
- Optional add-on: managed Watchtower monitoring ($149/mo) so a fixed High doesn't quietly come back
✕ What it is not
- A penetration test or CREST/OSCP letter
- A SOC 2 Type I/II, HIPAA, PCI, or ISO attestation
- A substitute for Vanta / Drata / an auditor
- A production agent, a fix studio, or "you are secure"
- Authorization by verify_jwt. The product exists because that flag isn't authorization
How it works
Book, then send source. The battery runs in minutes. A human reviews every High. You get the PDF in five business days.
Pick a repo
Read-only App or a zip, after you book. No production access, ever.
Battery runs
A named battery across Postgres/RLS, storage, every edge function's authz, and secrets. Gitleaks folded in by default, Semgrep on request.
Human review
We read every High, drop the false positives, and sign the cover. This is the part that isn't a machine.
Reviewed PDF
Verdict, ranked findings, remediation order, honest labels. A serious reader will finish it.
Every finding is labeled by confidence
We never dress an inference up as a proof. That labeling is the product.
A probe ran against your staging API and confirmed the finding. Proof, not inference. (Report + staging.)
Read from your schema, policies & migrations. A strong signal to confirm.
A guided review item. Surfaced honestly; excluded from the score.
A named third-party tool (Semgrep, gitleaks). Ingested and triaged, never counted as ours.
The engine is open source
The battery behind every Report is public. Read every check, then run it against your own code for free.
$ node --import tsx src/cli.ts connect-scan --dir .Runs locally · no telemetry · no phone-home
Free: run it yourself, unreviewed. Paid: a human-reviewed, signed Report, plus managed Watchtower monitoring. See pricing →
Pricing
Three things. Nothing hidden. Prices are per repository, per snapshot.
Report
- ✓One static battery on one repo (or a zip)
- ✓Postgres/RLS · storage · every edge function's authz · secret scan
- ✓Reviewed PDF: verdict, findings, remediation order
- ✓One written revision (paste a fix, we re-score)
- ✓No service_role · no production access
Report + staging
- ✓Everything in Report, plus a live pass against a staging project you name
- ✓VERIFIED stamp on cross-tenant isolation (two test tenants)
- ✓Delivery proof where CONFIG flagged a High
- ✓Staging only · no production · no DoS · you create the test users
Watchtower
- ✓Managed scheduled runs. We run it, nothing to maintain in your CI
- ✓Baseline history and drift: alerts only on a new High or one that re-opens
- ✓A human reviews every new or re-opened High before you're alerted
- ✓Quarterly snapshot PDF + diff since last Report
- ✓Repo-scoped token · Kloof never holds service_role
The first 10 Reports are half price if you allow a redacted public quote. Watchtower founding rate $99/mo for 12 months if it starts within 30 days of your Report.
Prefer to self-run? The open engine is free, AS IS.
See a sample report (fictional client, same shape)
An anonymized evidence report on a commercial-real-estate app: two high-severity findings, the reviewed downgrades, and the full disclaimer. Exactly what you'd receive. Illustrative, fictional client.
Straight answers
Yes. The CLI engine is open source. Run point-in-time checks on your own code, for free, AS IS and at your own risk. The paid Report adds human review, staging verification and a signed artifact; Watchtower adds managed monitoring.
Minutes is the engine. The $3,000 is the named battery that understands RLS and edge-function authorization, a PDF a serious reader will finish, and a human who won't ship a High we haven't read. Watchtower is $149/mo. We run it on a schedule, track drift against your baseline, and a human reviews any High that comes back.
No. It's an evidence battery. Run it first so a $20k pentest isn't wasted finding an unauthenticated endpoint we'd catch in a day.
You can show it as technical evidence toward CC6.x themes. It is not the SOC 2 report, and we won't badge it as one.
Keep it. We fold its output into the same report. But it doesn't understand a tenant boundary or that verify_jwt isn't authorization. That's where the breaches are.
No. Read-only repo (or a zip) for a Report. Staging only, with test users you create, for the VERIFIED stamp. Never production.
No report can say that, and we won't. This snapshot lists what the battery hit as of a date, what to fix, and what to prove next.
Prefer a call? Grab 20 minutes