Five days ago I shipped a Supabase security auditor. Today I shipped the fifth in the family — Firebase. Same pattern, five different backends. Here's the timeline, the patterns I keep seeing, and what's actually different about each one. The rough timeline May 5 — Supabase auditor (the original). Detects RLS-disabled tables, public buckets, exposed SECURITY DEFINER functions. May 9 morning — PocketBase. Detects empty API rules, the @request.auth.id != "" trap, true literals. May 9 mid-morning — Appwrite. Detects any and users role grants, document security misconfig. May 9 late morning — Hasura/Nhost. Detects anonymous role with open SELECT, user role missing row filter, public introspection. May 9 afternoon — Firebase. Detects the infamous match /{document=**} { if true; } , expired test-mode rules, auth-without-ownership. Each one is its own repo + npm package + MCP server + Apify actor. Pure Node.js, zero deps, MIT.…