for Supabase apps

Supabase RLS checker

No signup 路 no repo or GitHub access needed 路 passive, read-only checks 路 results in under a minute

See a sample report

Find out if your Supabase tables are readable by anyone. Paste your app link, tick the Supabase box if you own the project, and get a free score in under a minute. No sign-up.

Only scan apps and Supabase projects you own.

what_is_rls.txt

What RLS is, in two paragraphs

Row Level Security (RLS) is a Postgres feature that Supabase uses to decide which rows each request can see or change. Your app talks to Supabase from the browser with a public anon key, so the database itself has to enforce who sees what.

If RLS is off on a table in the public schema, anyone with your anon key can read it. Since that key is in your frontend code, that means anyone who opens your site.

check_manually.txt

How to check it yourself

  1. Open your Supabase dashboard. Go to Advisors, then Security Advisor.
  2. Look for "RLS Disabled in Public". Every table listed there can be read with your anon key.
  3. Enable RLS on each table. In the Table Editor, or with: alter table public.your_table enable row level security;
  4. Add policies. Enabling RLS with no policies blocks everything. Add policies that let each user read and change only their own rows, for example auth.uid() = user_id.
  5. Test it. Use your app logged out and as a second user, and confirm you only see what you should.
common_mistakes.log

Common RLS mistakes

  • RLS turned off

    The table is readable by anyone who has your anon key, and your anon key is in your frontend.

  • A policy that allows everyone

    RLS is on, but a policy like using (true) on select means it isn't restricting anything.

  • service_role key in client code

    This key bypasses RLS completely. It belongs on the server only.

  • Forgetting new tables

    RLS is per table. Tables added later need their own policies.

how_vibepatrol_helps.txt

What the scan does for Supabase

  • Flags a Supabase service_role key in your page or JavaScript as critical.
  • Notes when your Supabase URL and anon key are in your frontend, so you know RLS is doing the protecting.
  • With your opt-in, tests common table names for anonymous reads and flags any that return data.
  • Also checks for leaked API keys, exposed files and missing security headers.
faq.txt

FAQ

Isn't the anon key a secret?
No. It's meant to be public and it ships in your frontend. That's why RLS policies are the real lock on your data.
Which tables does the scan test?
Only with your opt-in, and only if we find your Supabase URL and anon key in your frontend. We then try a fixed list of common names: users, profiles, customers, orders, payments, subscriptions, messages, posts, todos, accounts, leads, invoices, contacts, api_keys and settings. Tables with other names aren't tested, so also check Security Advisor.
Do you see my data?
The opt-in test asks for at most 1 row per table and only records whether data came back. Row contents are never stored or shown.
Do I need to sign up?
No. Paste your link, confirm it's your app, and run it. The scan and score are free. The full report with fix prompts is a one-time $9, or $29 for 10.
Does it read my policies?
No. It checks what your app exposes from the outside. It can't see your policies or tables it isn't told about.

Run the free scan