Is your Supabase database
actually locked down?

Paste your migration SQL below and get an instant Row Level Security audit โ€” missing RLS, always-true policies, leaky views, dangerous grants, and the exact SQL to fix each one.

๐Ÿ”’ Runs entirely in this browser tab โ€” your SQL is never uploaded
supabase/migrations/*.sql โ€” paste one file or all of them
13 rules ยท migration-aware ยท free ยท no signup

What it checks

The same classes of misconfiguration behind most real-world Supabase data leaks.

RuleDetectsSeverity
RLS-001Table in an exposed schema without RLS enabledCritical
RLS-002RLS enabled but zero policies (silent lockout)Medium
RLS-003Always-true policy conditions like USING (true)High / Critical
RLS-004INSERT policy missing WITH CHECKHigh
RLS-005Owner/tenant column never referenced by any policyHigh
RLS-006Write policies applied to the PUBLIC roleHigh
RLS-007Policies with no row condition (defaults to TRUE)High / Critical
STORAGE-001Storage write policies without a bucket_id boundaryHigh
GRANT-001Write privileges granted to anon/publicHigh
ROLE-001Database roles with SUPERUSER or BYPASSRLSCritical
FUNC-001SECURITY DEFINER functions with unpinned search_pathHigh
VIEW-001Views without security_invoker (RLS bypass)High
SECRET-001Service keys / connection strings pasted into SQLCritical

Fail unsafe migrations in CI

The browser scanner and CLI use the same engine. Scan ordered migration files, choose a severity threshold, and emit JSON, Markdown, or SARIF for GitHub Code Scanning.

  • Exit 1 at or above your chosen severity
  • Migration-aware across ALTER, DROP, and REVOKE
  • Secret-safe reports never echo matched key values
CLI setup on GitHub โ†’ 
# Fail on Critical findings (default)
node cli.js supabase/migrations/*.sql

# Use a stricter threshold
node cli.js --fail-on high \
  supabase/migrations/*.sql

# Machine-readable output
cat migration.sql | node cli.js --json
node cli.js --format markdown --output rls-report.md supabase/migrations/*.sql
node cli.js --format sarif --output rls-guard.sarif supabase/migrations/*.sql
From finding to prevention

Found a risk? Apply the fix, test each role, and stop regressions in CI.

Finding RLS risks is free. Prove real role access and prevent regressions with the Security Kit.

The free scanner diagnoses supplied SQL. The paid kit connects the result to an explicit access contract, live role tests, CI blocking, and remote schema drift detection.

Free scanner Find 13 SQL risk patterns
Get remediation examples
Run locally without signup
  • 12 SQL recipes for ownership, multi-tenancy, Storage, RPC, views, and functions
  • Role ร— CRUD ร— resource matrix to define the access contract before writing policies
  • 16 pgTAP checks + GitHub Actions for anon, member, owner, and service_role
  • Dashboard drift detector to catch remote schema changes missing from migrations
16 / 16pgTAP demo passed
12Reusable SQL recipes
3 gatesStatic scan ยท pgTAP ยท drift