Open-source Supabase RLS scanner + human audit
Prove your app can't leak user A's data to user B.
A 48-hour, human-reviewed Supabase Row Level Security audit for founders. Built on a checklist we publish before you pay, plus a free open-source RLS scanner you can run right now.
§01
The pain is documented, not theoretical
Supabase ships fast. That's the appeal, and the risk. Row Level Security (RLS) has to be turned on, and turned on correctly, or the app looks private in the browser while the same data is wide open through the API underneath it.
auth tokens and 35K emails exposed in the Moltbook breach. Root cause was missing Row Level Security.
Disclosed by Wiz, Jan–Feb 2026
of 1,072 scanned vibe-coded production apps had at least one security flaw; 300+ exposed database keys client-side.
Symbiotic Security, "State of Vibe-Coded Security 2026"
of vibe-coded apps were found leaking Supabase keys outright, enough to spark its own Hacker News thread.
HN discussion, Jan 2026
§02
What actually gets checked
Every Supabase RLS audit follows the same five stages. The full checklist is published at docs/audit-methodology.md so you can judge it before you pay for it, not after.
Intake
App URL, Supabase project URL, written authorization, two normal test-user accounts, your team/org/ownership model, sensitive tables and buckets in scope.
Static review
Frontend bundle and migrations scanned for exposed keys, missing RLS, permissive policies, and risky SECURITY DEFINER functions.
Dynamic cross-user testing
Logged in as two real accounts, we attempt user A reading, writing, and deleting user B's rows and files, via direct API calls rather than the UI.
Human-only · no scanner does thisReport
A launch verdict, severity-ranked findings with evidence, plain-English explanations, SQL fix suggestions, and a retest checklist.
Follow-up
One short call or async recording walking through findings. Remediation and retesting are separate, optional add-ons.
§03
Free scanner, or a paid audit
Run the open-source Supabase RLS scanner yourself for free, as many times as you want. Pay only for what it can't do: logging in as two real users and proving cross-account access is actually blocked.
Wrote ./rlsproof-report.md
✓ 0 Launch Blockers · 1 Fix Soon · 2 Informational
- Cross-user access test on up to 2 tables you choose
- Key & secret exposure review
- 24-hour turnaround
- Up to 15 tables
- Cross-user read/write/delete testing
- Storage & RPC review
- Severity-ranked report + SQL fixes
- 1 follow-up call, 48-hour turnaround
- Everything in Launch Audit
- Client-facing handoff report
- Signoff checklist
- Post-fix retest
§04
What a report looks like
Excerpt from a sample report. "TaskFlow" is a fictional app used to demonstrate format and depth, seeded from the scanner's own public vulnerable-fixture example.
RLS is enabled, but USING (true) and WITH CHECK (true) grant unconditional access. Logged in as User A, we read and overwrote User B's notes directly via the REST API.
Callable by the authenticated role, bypassing the caller's RLS and returning every user's notes.
No elevated privileges found on the public anon key. No action needed.
§05
Before you ask
Is this a full penetration test?
No. It's a focused Supabase data-isolation review: RLS, storage, RPCs, secrets. That narrower scope is exactly why it's faster and cheaper than a full pentest.
Supabase already has a Security Advisor. Why do I need this?
Use it. It's a good baseline, and it's gotten better at catching "RLS is completely off." What it can't tell you is whether a policy that exists is actually correct for your team/org model. That's a human judgment call, tested against real accounts.
Do I need to hand over my service_role key?
Not by default. We prefer staging environments, test accounts, and schema/migration files. If elevated access is genuinely required for a specific check, we scope that narrowly with temporary or revocable credentials.
Can you guarantee my app is secure afterward?
No responsible audit can promise that. This is a point-in-time diagnostic review with documented scope and evidence, not a certification, and not a guarantee that every issue has been found.