Blast-radius calculator

A quick way to reason about exposure. Runs entirely in your browser; nothing is sent to our servers. All outputs are illustrative estimates from your own assumptions.

Leaked paid API key

Estimate the spend an abuser could run up before you rotate the key.

Hours until rotationAbusive requests per hourYour assumptionCost per 1,000 requests (USD)Check your provider's pricingProvider spend cap (USD, 0 = none)

36,000 requests ≈

$72

Table without RLS

If a table is readable with the public anon key, every row is in scope.

Rows in the tableDistinct people in those rowsPersonal fields per rowe.g. email, name, phone

5,000

records readable

800

people affected

15,000

personal data points

Illustrative estimates only. These numbers are simple arithmetic on the assumptions you enter — they are not measurements, benchmarks or data from real incidents. Default values are placeholders. Actual impact depends on provider pricing, rate limits, and what the data contains.