Observed arrival · 2026-10-20
Rowok checks whether user B can reach user A’s data
A security-checking tool for rapidly built apps that tests whether one logged-in user can read, change, or delete another user’s data.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Builders testing Supabase or Firebase apps
- Worth noticing
- Active probes require a DNS TXT record or /.well-known/rowok-verify.txt; the site says they touch only marker rows created for the test.
Field notes
The described teaser checks public-facing signals without accessing a database; deeper testing stays off until the site owner publishes a verification token. For the full check, Rowok says it creates marker rows for two test users and limits its read, update, and delete probes to those rows. The page also says findings include fix prompts and that a re-scan can show which issues remain open.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
$PaidCommerce or pricing visible
✦PrettyNotable craft visible
◎NicheUnusually specific use
One card from the complete issue