Is the Supabase RLS checker free?

Supabase public exposure checks are part of signed-in Security audits on the free Basic plan within its limits. No domain verification is needed for these audits. The no-signup instant scan does not include Supabase API checks.

Does the scan read my table data?

The Supabase check uses count-only HEAD requests and does not retrieve table rows. Discovery is limited to public configuration and exposed schema; counts cannot establish whether readable contents are confidential.

Does a passing result prove tenant isolation?

No. Tenant isolation means keeping each user or workspace's data separate. Test authenticated read and write behavior with separate disposable identities; the public checker cannot establish that isolation.

VibeShield audit tools

Supabase RLS Checker for AI-Built Apps

Check what a signed-out visitor can discover through your app's public Supabase configuration. VibeShield uses count-only requests to identify readable tables, then helps you review whether that access matches your intended audience.

Create a free account

Included in Basic within plan limits. Create a free account and enter your website URL.

How the Supabase RLS checker works

Create a free Basic account, enter your public app URL and select Security. When the scan discovers a Supabase project URL and browser-suitable public key, it checks the exposed API schema and uses HEAD requests against up to eight tables. It reports counts without downloading row contents. The anonymous instant scan does not query Supabase.

Readable rows do not prove RLS is disabled

Row Level Security (RLS) controls which rows a database role can access. An enabled policy may intentionally permit public reads. Treat a count result as evidence of visibility under the tested role, then review grants, policies and views against your app's intended access model.

Zero rows and unavailable checks need a follow-up

Zero visible rows can mean an empty table or no rows permitted for the request. An undiscovered project, unavailable API or blocked check is an untested area. Use harmless fixtures in your own staging environment to distinguish these cases; a green summary cannot establish every table's safety.

Public keys and private credentials have different purposes

Supabase publishable and legacy anon keys are designed for public clients. Secret and legacy service-role keys belong on trusted server infrastructure. Review the key type before treating browser-visible configuration as a secret leak.

Test private data with two users

For owner-only data, create a disposable record for user A in staging. Confirm A's permitted read and write actions, then confirm user B and a logged-out visitor cannot read or change it. Test insert, update and delete separately. The URL checker does not perform these authenticated or write-access tests.

Use the checker alongside your database tools

Review Supabase's Security Advisor and, if you use Lovable, its built-in security checks. Those tools can inspect project settings that a public URL scan cannot see. After a policy change, test both intended access and denied access before repeating the public check.

Further guidance: Supabase row-level security documentation.

Practical guides for your next check

Common questions

Is the Supabase RLS checker free?: Supabase public exposure checks are part of signed-in Security audits on the free Basic plan within its limits. No domain verification is needed for these audits. The no-signup instant scan does not include Supabase API checks.
Does the scan read my table data?: The Supabase check uses count-only HEAD requests and does not retrieve table rows. Discovery is limited to public configuration and exposed schema; counts cannot establish whether readable contents are confidential.
Does a passing result prove tenant isolation?: No. Tenant isolation means keeping each user or workspace's data separate. Test authenticated read and write behavior with separate disposable identities; the public checker cannot establish that isolation.

Explore the other audit tools

Compare plans or follow the AI app security checklist before launch.