Security checks for AI-built Supabase apps

Your AI wrote the schema.
Nobody wrote the policies.

Paste your deployed URL and see, in under ten seconds, which tables your public anon key can read — and whether a service_role key shipped in your bundle. Free, no account, read-only, nothing stored.

Run a free read-only audit

No account, and nothing is ever written to your database.

No signup

The URL check is free, and so is one connected project with a daily audit and email alerts. More projects and faster scans start at $29/month, only when you turn them on — nothing is billed before that. See the plans

GET, HEAD and OPTIONS onlyUnder 10 secondsNothing stored

Connected audit — sample project

health F · 7 findings · 25 ms

Nine rules over the demo project's catalogue, computed by the rule engine at build time. The free URL check beside this table returns the two probe rules only.
table_name	rls_enabled	row_filter	status
invoices	off	service_all ALL USING (true)	RLS_DISABLED
profiles	on	—	RLS_NO_POLICIES
posts	on	public_read SELECT USING (true)	RLS_TAUTOLOGY
comments	on	select_own SELECT USING ((auth.uid() = user_id)) · insert_any INSERT USING (—)	MISSING_WITH_CHECK, RLS_UNWRAPPED_AUTH_CALL, UNINDEXED_RLS_PREDICATE
storage.objects	on	—	OK
buckets: avatars (public → PUBLIC_BUCKET_EXPOSURE) · receipts (private)

Keep watching after launch

Find the hole. Track the drift. Fix it.

RowShield turns a one-time security check into a signal you can keep acting on.

Scheduled policy scans

RLS, storage, key exposure and policy-performance checks run on the cadence your plan needs.

Drift you can act on

See what appeared, came back after a fix, or disappeared instead of reading the same report every time.

Alerts on transitions

Slack, Discord, email or webhooks notify you when a finding changes state, not every time a scan runs.

Start with the failures that matter

Each finding comes with the SQL that fixes it, generated from your actual columns.

criticalRow Level Security disabled

Any table reachable through PostgREST with RLS disabled is world-readable to anyone holding the anon key — which ships in your client bundle and is public by design. Every row is exposed.

RLS_DISABLED

criticalPolicy always evaluates to true

A permissive policy whose expression is a constant true grants the whole table to every role it targets. RLS is enabled, so the dashboard reports the table as protected while it is wide open.

RLS_TAUTOLOGY

criticalservice_role key shipped to the browser

The service_role key bypasses RLS entirely. Once it is in a client bundle it is public, and every policy in the project is decorative. Rotate the key immediately and move the calls that need it behind a server route.

SERVICE_ROLE_KEY_EXPOSED

View all detection rulesNine checks across your catalog and public surface.

Built with Lovable, Bolt, Cursor or v0? Start here.

If an AI tool generated your schema, the row-level security policies are the part it most often leaves unfinished. Paste your app's URL above and see what your anon key can read right now.

What the free check sees — and what it doesn't

Sees

Tables readable with the public anon key
A service_role key shipped to the browser

Does not see (until you connect)

RLS disabled on a table
Tables with no policies
Always-true policies
INSERT policy with no WITH CHECK
Unindexed RLS predicates
Public storage buckets
Unwrapped auth() calls
Drift between scans

Is it safe to expose my Supabase anon key?: It is safe only when the tables that key can reach are meant to be public. The free check tests selected publicly reachable paths — which tables answer the anon key, and whether a service_role key is in the bundle. It does not establish that every row-level security policy is correct. That is what the connected audit is for.
What does "nothing stored" mean here?: The probe keeps no URL, no result and no log line with your project in it; when the dialog closes, it is gone.
Why only GET, HEAD and OPTIONS?: Because reading is enough to show what the anon key can read; the probe never writes, and it refuses a service_role key before sending anything.

Continuous monitoring

Keep your security check running after launch

Start with the free audit. Connecting one project keeps the nine-rule audit running daily. Choose a paid plan when you want more projects or faster scans.

RowShield Indie

$29 / month

or $290/yr

For one developer shipping fast.

Up to 3 projects
Hourly scans
Email and Slack alerts
1 seat
Full findings and remediation SQL

RowShield Team

$99 / month

or $990/yr

For a team that has customers to answer to.

Up to 15 projects
15-minute scans
Email, Slack, Discord and custom webhooks
Unlimited team seats
Full findings and remediation SQL

RowShield Growth

custom

from $279 / month

For agencies and platforms monitoring many customer projects.

Get product updates

Leave your email for release notes and pricing updates — the free audit is available today.

Founding customers (first 100) lock in 25% off annual forever.

Start here

Check your public Supabase surface

Run the free read-only audit on a deployed app. No account, database writes or configuration are required.

Run free audit Read detection rules

Your AI wrote the schema. Nobody wrote the policies.