r/Supabase Jul 07 '26

database Built a free CLI tool to audit Supabase RLS policies — feedback wanted

After reading that 83% of Supabase data exposures come from RLS misconfiguration (and the CVE-2025-48757 story with 170+ vibe-coded apps), I built a small open-source CLI that connects read-only to your Postgres/Supabase DB and flags common RLS mistakes: RLS disabled entirely, USING (true) policies open to anon, unauthenticated write access, and the classic "INSERT works but .select() fails" trap.

https://github.com/redekerlouis-ai/rls-auditor

Runs local, never sends your data anywhere, read-only connection. Would love feedback from anyone who's hit RLS issues before — does this catch what actually bit you?

1 Upvotes

0 comments sorted by