# MondayMedic

> A weekly security and health checkup for apps built fast, often on Supabase.

MondayMedic lets anyone paste a public app URL and run a free, read-only check. Paid plans (Solo $9 USD/month for 1 app, Studio $29 USD/month for up to 10 apps) unlock the full notes, ownership-gated deep scans, and a Monday email. Pay at Stripe checkout before paid features open.

Address: 8 Rolleston Dale, Alexander Heights, Perth WA 6064, Australia.

## What the free check looks for

- Secret keys in public HTML or scripts (Supabase service role, sb_secret, live Stripe secret keys, AWS access key ids, GitHub tokens, private key blocks). The public Supabase anon key is normal and is not treated as a leak by itself.
- Supabase tables that return rows to the public anon key. The check is read-only and stores no row values.
- The text using(true) or with check (true) in public code.
- Sign-up or login paths that return a server error.
- Public pages that say a project is paused or over a free limit.

## What it does not do

- It does not log in, exploit, or change data.
- It is not a penetration test.
- It does not invent reviews, user counts, or countdown timers.

## Pages

- https://mondaymedic.com/ home
- https://mondaymedic.com/scan free checkup
- https://mondaymedic.com/pricing Solo $9 and Studio $29
- https://mondaymedic.com/guides/lovable-supabase-rls-check-fix RLS guide
- https://mondaymedic.com/privacy
- https://mondaymedic.com/terms
- https://mondaymedic.com/llms.txt this file

## FAQ

The Supabase anon key in frontend code is expected. Flag the service role key, and flag tables of private data that answer the public key.
Deep scans require a paid plan and a DNS TXT record or a /.well-known/mondaymedic.txt file on the app's host.
The optional pause warning stores an email opt-in in Cloudflare D1. Every marketing email has an unsubscribe link.