RLS Guard: check whether your Supabase Row-Level Security is exposing other users' data

A read-only scanner that checks your Supabase (PostgreSQL) project for missing or misconfigured Row-Level Security policies, the RLS gap most common in AI-assisted ("vibe-coded") apps. Run one short, auditable select query in your own Supabase SQL Editor and paste the result here. The scan is free; detailed findings and exact remediation SQL are available for a one-time $29 payment. We never see a connection string, and nothing you paste leaves your browser.

Step 1: run this in your Supabase SQL Editor

It's a read-only select against Postgres's own system catalogs; nothing here can modify your database. Read it before you run it.

select json_agg(row_to_json(x)) as scan_result
from (
  select
    t.schemaname,
    t.tablename,
    t.rowsecurity as rls_enabled,
    coalesce(
      json_agg(
        json_build_object(
          'policyname', p.policyname,
          'permissive', p.permissive,
          'roles', p.roles,
          'cmd', p.cmd,
          'qual', p.qual,
          'with_check', p.with_check
        )
      ) filter (where p.policyname is not null),
      '[]'::json
    ) as policies,
    coalesce(
      (select json_agg(c.column_name)
       from information_schema.columns c
       where c.table_schema = t.schemaname and c.table_name = t.tablename),
      '[]'::json
    ) as columns
  from pg_tables t
  left join pg_policies p
    on p.schemaname = t.schemaname and p.tablename = t.tablename
  where t.schemaname = 'public'
  group by t.schemaname, t.tablename, t.rowsecurity
  order by t.tablename
) x;

Step 2: paste the result back here

Copy the result from Supabase and paste it here as-is.

FAQ

What does RLS Guard check?

It scans your Supabase (PostgreSQL) project's Row-Level Security policies for the most common misconfigurations: RLS disabled entirely, RLS enabled with no policies, and policies that unintentionally leave anon, authenticated, or public roles with unrestricted access.

Does RLS Guard see my database or credentials?

No. You run one read-only SQL query yourself in the Supabase SQL Editor and paste the JSON result here. RLS Guard never asks for a connection string, and analysis runs entirely in your browser.

Is this a full security audit?

No. RLS Guard checks one vulnerability class: Row-Level Security misconfiguration. It's a fast first check, not a substitute for a full security review.

What's included in the paid report?

Affected table names, policy names, an explanation of each issue, and the exact SQL to fix it, ready for you to review and run yourself.