RLS Guard: check whether your Supabase app leaks other users' data
A read-only Supabase RLS scan that shows whether your app may be exposing other users' data, especially common in AI-assisted ("vibe-coded") apps. Run one short, auditable select query in your own Supabase SQL Editor and paste the result here. The scan is free; detailed findings and exact remediation SQL are available for a one-time $29 payment. We never see a connection string, and nothing you paste leaves your browser.
Step 1: run this in your Supabase SQL Editor
It's a read-only select against Postgres's own system catalogs; nothing here can modify your database. Read it before you run it.
select json_agg(row_to_json(x)) as scan_result
from (
select
t.schemaname,
t.tablename,
t.rowsecurity as rls_enabled,
coalesce(
json_agg(
json_build_object(
'policyname', p.policyname,
'permissive', p.permissive,
'roles', p.roles,
'cmd', p.cmd,
'qual', p.qual,
'with_check', p.with_check
)
) filter (where p.policyname is not null),
'[]'::json
) as policies,
coalesce(
(select json_agg(c.column_name)
from information_schema.columns c
where c.table_schema = t.schemaname and c.table_name = t.tablename),
'[]'::json
) as columns
from pg_tables t
left join pg_policies p
on p.schemaname = t.schemaname and p.tablename = t.tablename
where t.schemaname = 'public'
group by t.schemaname, t.tablename, t.rowsecurity
order by t.tablename
) x;Step 2: paste the result back here
Click the single scan_result cell in the SQL Editor's output and paste its full value below.