Skip to content
Lockpick
How it works
Sign inCheck my site

You built it.Know what you left open.

Lockpick checks your public site, shows what an attacker could use, and hands your coding agent the fix.

01234567890123456789,01234567890123456789012345678957,871 new vulnerabilities published this year.

  1. We look at your homepage the way an attacker would.
  2. We explain what we found in plain words.
  3. We write the prompt that fixes it.

More bugs, exploited sooner.

Your public site is the first thing an attacker can reach.

  • 01234567890123456789,01234567890123456789012345678957,871vulnerabilities published worldwide in 2026, a live estimate
  • 2.7×as many last quarter as a year before, 30k vs 11k
  • 135exploited the day they went public, first half of 2026
  • #1web and plugins, the most exploited in 2026, 211 of 679

One leaked key, found and fixed.

Found by Lockpick. Atlas is fictional. The mistake is common.

atlas.example
AAtlasStudio

Good morning, Studio

1,248 customers37 invoices due

View source/_next/static/chunks/app.js

  1. (self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[931],{
  2. 1204:function(e,t,n){"use strict";n.r(t),n.d(t,{default:function(){return s}});
  3. var r=n(7437),a=n(2265),i=n(6463);function l(e){return e.replace(/\s+/g," ")}
  4. let o={sm:640,md:768,lg:1024},u=(0,a.createContext)(o);
  5. function s(e){let{title:t,children:n}=e;return(0,r.jsx)("section",{children:n})}
  6. },3310:function(e,t,n){n.d(t,{Z:function(){return c}});var r=n(2265);
  7. function c(e){let[t,n]=(0,r.useState)(!1);return[t,()=>n(e=>!e)]}
  8. },4821:function(e,t,n){"use strict";n.d(t,{db:function(){return o}});
  9. var r=n(2265),a=n(8830);let c=(0,r.createContext)(null);
  10. function u(e){let{children:t}=e;return(0,r.useMemo)(()=>t,[t])}
  11. let i={SUPABASE_URL:"https://db.atlas.example",
  12. SUPABASE_SERVICE_ROLE_KEY:"eyJhbGciOiJI…"},
  13. o=(0,a.createClient)(i.SUPABASE_URL,i.SUPABASE_SERVICE_ROLE_KEY);
  14. function l(){return o.from("customers").select("*")}
  15. function d(e){return o.from("customers").delete().neq("id",e)}

customersAnyone who opens atlas.example

NameEmail
Mara Quinnmara@northwind.example
Theo Alberstheo@kestrel.example
Ines Duarteines@fieldnote.example
and 1,245 more rowsDelete all 1,248

Lockpick

Database admin key in the website's code

FoundPulse, 22 Sep, 09:58 UTC

atlas.example
AAtlasStudio

Good morning, Studio

1,248 customers37 invoices due

View source/_next/static/chunks/app.js

  1. (self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[931],{
  2. 1204:function(e,t,n){"use strict";n.r(t),n.d(t,{default:function(){return s}});
  3. var r=n(7437),a=n(2265),i=n(6463);function l(e){return e.replace(/\s+/g," ")}
  4. let o={sm:640,md:768,lg:1024},u=(0,a.createContext)(o);
  5. function s(e){let{title:t,children:n}=e;return(0,r.jsx)("section",{children:n})}
  6. },3310:function(e,t,n){n.d(t,{Z:function(){return c}});var r=n(2265);
  7. function c(e){let[t,n]=(0,r.useState)(!1);return[t,()=>n(e=>!e)]}
  8. },4821:function(e,t,n){"use strict";n.d(t,{db:function(){return o}});
  9. var r=n(2265),a=n(8830);let c=(0,r.createContext)(null);
  10. function u(e){let{children:t}=e;return(0,r.useMemo)(()=>t,[t])}
  11. let i={SUPABASE_URL:"https://db.atlas.example",
  12. Key removed
  13. o=(0,a.createClient)(i.SUPABASE_URL,i.SUPABASE_ANON_KEY);
  14. function l(){return o.from("customers").select("*")}
  15. function d(e){return o.from("customers").delete().neq("id",e)}

customersAnyone who opens atlas.example

NameEmail
Mara Quinnmara@northwind.example
Theo Alberstheo@kestrel.example
Ines Duarteines@fieldnote.example
and 1,245 more rowsDelete all 1,248

permission denied for table customersThe website's public key can not read this table.

Lockpick

Database admin key in the website's code

FixedRechecked 22 Sep, 10:41 UTC

Before. Atlas's database admin key is in the website's code, and anyone who opens the site can open the customer table.

What we saw

A key that unlocks the whole database was sitting in the website's code.

Technical detail

Found in 1 of 4 scripts the homepage loads, /_next/static/chunks/app.js. A Supabase JWT starting eyJhbGciOiJI (redacted here) carries the role service_role, which skips row level security. Lockpick read the script the way any browser does and did not use the key.

What someone could do

Read, change or delete every customer record. No password needed.

The prompt

A ready-to-paste prompt for your coding agent. Rotate the key, move it to the server, lock the table, then recheck.

Free during the pilot.

What it checks

  • Your public homepage
  • At most 10 requests
  • About 2.5 minutes

What it does not do

  • No sign-in testing
  • No form submissions
  • No customer data

What you need

  • Sign in
  • Prove you own the site
  • 3 assessment runs included to start
Check my site

Public HTTPS pages only. Assess only sites you are authorised to test. An observation describes what was checked; it does not prove an exploit or complete security.

Check your site before you share the link.

Check my site

Only pick locks you own.

Lockpick
MethodologySign in

Lockpick assesses public pages you are authorised to test.