Do I have to give you a database credential?

For continuous monitoring, yes — a Postgres connection string, ideally a role with catalog read access and nothing else. It is envelope-encrypted with AES-256-GCM under a KMS-held key and bound to your organization, so a ciphertext lifted into another tenant's row will not decrypt.

Can I try it without connecting anything?

Yes. The public probe needs only a URL and uses your public anon key, the same access an attacker has.

Guides

What the Supabase Security Advisor does not do

The Supabase Security Advisor is good and you should use it. It is also a page you have to remember to open, in a dashboard you visit when something is already wrong.

What follows is an honest comparison, including where the advisor is ahead.

Rules that check this

criticalRow Level Security disabledRLS_DISABLED
highRLS enabled but no policiesRLS_NO_POLICIES
criticalPolicy always evaluates to trueRLS_TAUTOLOGY
highWrite policy without WITH CHECKMISSING_WITH_CHECK
mediumRLS predicate column is not indexedUNINDEXED_RLS_PREDICATE
highStorage bucket is publicPUBLIC_BUCKET_EXPOSURE
mediumauth.uid() not wrapped in a subqueryRLS_UNWRAPPED_AUTH_CALL

Where VibeGuard adds something

It runs on a schedule rather than on demand, so a policy dropped on Tuesday is caught on Tuesday.

It diffs against the previous run, so you see what changed rather than a full list every time — and a fix that regresses is labelled as a regression.

It alerts to Slack, Discord, email or a webhook on transitions, and exits non-zero in CI so a pull request can fail on a new critical.

It generates remediation SQL from your actual columns, not a template with placeholders.

Where the advisor is ahead

It checks SECURITY DEFINER views, function search_path mutability, and several auth configuration items that VibeGuard does not cover.

It is built into the dashboard, has no cost, and needs no credential handling at all. If a periodic manual check is enough for your project, it is enough.

Reading your database

VibeGuard reads `pg_catalog` and `storage.buckets` metadata only. Every statement it runs is a module-level constant with nothing interpolated and no bind parameters, so there is no code path that could be steered into a user table. The full query list is exported for audit.

Frequently asked

Do I have to give you a database credential?: For continuous monitoring, yes — a Postgres connection string, ideally a role with catalog read access and nothing else. It is envelope-encrypted with AES-256-GCM under a KMS-held key and bound to your organization, so a ciphertext lifted into another tenant's row will not decrypt.
Can I try it without connecting anything?: Yes. The public probe needs only a URL and uses your public anon key, the same access an attacker has.

Check your project in about ten seconds

Paste a URL. No signup, no writes, nothing stored.

Run the free audit