Paste a schema.prisma, a Supabase or Postgres dump, a Drizzle schema, plain CREATE TABLE SQL, or a schema.cresco. You get a map of which tables hold data about real people, and what, if anything, is standing in front of them.
↳
Nothing leaves this page. It all runs in your browser: there is no request to check, nothing stored, and no account. Open your network tab, or turn off your wifi, and run it anyway. Paste a client's schema without thinking twice.
No schema to hand? Try one of these.
Reads Prisma, Drizzle, Postgres, MySQL, SQLite, Supabase dumps and schema.cresco.
What this does not do
It reads column names, not your data. So notes_about_the_patient is invisible to it, and email_template_id is a false positive. The patterns are deliberately broad: a false positive costs you one line in a report, a false negative costs somebody their users' data.
It cannot see your application code. If your authorisation lives in middleware, a resolver or a route handler, this has no way to read it and does not pretend to.
It is not a penetration test and not a security audit. It answers one question from one file.
It reads shapes, not dialects. If the table and column count it reports back looks wrong, trust your eyes over the tool.