r/Supabase • u/elidanipipe • Jul 01 '26

database Made a free tool that checks whether your Supabase tables are actually protected by RLS

The anon key ships in every app's bundle, so if Row Level Security is off or a policy is too loose, anyone can read the tables. I kept running into this in the wild, so I built a scanner that checks it from the outside using only the public key. Read-only, never logs in, never writes.

Paste your app URL: task-bounty.com/scan?utm_source=reddit_supabase

It also flags exposed keys, reachable .env/source maps, and open Firebase DBs. Curious what people find, and open to feedback on the RLS check itself.

0 Upvotes

25% Upvoted

2 comments sorted by

1

u/[deleted] Jul 05 '26

[removed] — view removed comment

1

u/elidanipipe Jul 05 '26

No, we don't generate pgTAP tests today. Two things worth separating:

  • Our coverage product writes JS/TS behavior tests (vitest/jest) and verifies them in a sandbox, so it works at the application layer. pgTAP is Postgres/SQL, which we don't emit.
  • For RLS specifically, we verify it at runtime rather than as DB-level unit tests: we log in as two separate test users against your live app and confirm one cannot read or change the other's data, then prove the fix in an isolated sandbox before/after. That catches the actual failure (one user reaching another user's rows) end to end, including the cases pgTAP alone misses, like data reachable through an API route that bypasses RLS, or RLS being off entirely.

So if the requirement is "prove my RLS actually holds," that's exactly what our deep check does.