RLS Guard: check whether your Supabase app leaks other users' data

A read-only Supabase RLS scan that shows whether your app may be exposing other users' data, especially common in AI-assisted ("vibe-coded") apps. Run one short, auditable select query in your own Supabase SQL Editor and paste the result here. The scan is free; detailed findings and exact remediation SQL are available for a one-time $29 payment. We never see a connection string, and nothing you paste leaves your browser.

Step 1: run this in your Supabase SQL Editor

It's a read-only select against Postgres's own system catalogs; nothing here can modify your database. Read it before you run it.

select json_agg(row_to_json(x)) as scan_result
from (
  select
    t.schemaname,
    t.tablename,
    t.rowsecurity as rls_enabled,
    coalesce(
      json_agg(
        json_build_object(
          'policyname', p.policyname,
          'permissive', p.permissive,
          'roles', p.roles,
          'cmd', p.cmd,
          'qual', p.qual,
          'with_check', p.with_check
        )
      ) filter (where p.policyname is not null),
      '[]'::json
    ) as policies,
    coalesce(
      (select json_agg(c.column_name)
       from information_schema.columns c
       where c.table_schema = t.schemaname and c.table_name = t.tablename),
      '[]'::json
    ) as columns
  from pg_tables t
  left join pg_policies p
    on p.schemaname = t.schemaname and p.tablename = t.tablename
  where t.schemaname = 'public'
  group by t.schemaname, t.tablename, t.rowsecurity
  order by t.tablename
) x;

Step 2: paste the result back here

Click the single scan_result cell in the SQL Editor's output and paste its full value below.