Best fit
Review a supplied project for row-level-security configuration risks.
// database security
Supabase RLS Doctor
Audit local Supabase migrations and client code for the row-level-security mistakes that can expose data, with severity, exact evidence, and a verification step for every review target.
Format: Agent skill, not a browser app. You need an AI agent that can load its instructions and use the required tools.
Package requirements: Agents that read the open SKILL.md format. Verify runtime and service requirements at the purchase or install destination.
You get: Local, read-only findings on RLS policies, authentication checks, service-role key exposure, storage access, grants and migration drift. It does not certify the deployed project.
Licence and purchase details
Review the package licence at the destination.
Review the offer and access method at your chosen marketplace. Agensi provides connected-agent access, not a download. Buying a skill does not include an AI-agent subscription or setup service.
Agensi access: This product’s bundled-script workflow through Agensi has not been verified here. Tests of other products do not establish this package’s compatibility. Local setup examples apply to separately obtained downloadable packages.
What it inspects
- Tables with missing or disabled row-level security.
- Policies that appear to grant broad anonymous or authenticated access.
- Missing
auth.uid()ownership checks on user-scoped data. - Secret or legacy
service_rolekey references in frontend initialization. - Storage bucket policies, ownership rules, and public-access review targets.
- Overbroad grants and multi-tenant ownership conditions.
- Migration and schema evidence that may not match the intended deployed state.
What you give it
Point the workflow at the local project evidence you want reviewed: SQL migrations and policy files, Supabase client initialization code, a database schema snapshot, and storage policy configuration. Declared file scopes include its own package, matching *.sql files, and supabase/migrations/*.
The scanner uses the Python 3 standard library. If Python or matching files are unavailable, the skill falls back to its manual checklist instead of inventing a result.
What comes back
The local scanner prints Markdown or JSON findings. Each finding is ranked from Critical to Info and includes the affected object or file, exact review evidence, impact, a proposed fix, and a verification step. The checklist then covers policy semantics and live-project boundaries the heuristic scan cannot prove.
$ scan local Supabase evidence
CRIT profiles: migration creates table without enabling RLS
HIGH posts_select: review
USING (true) for public intentMED avatars: confirm public bucket is intentional
read-only evidence, remediation, verification
Useful before
- Launching a Supabase-backed web or mobile app.
- Merging a migration that adds a table, policy, view, function, or storage rule.
- Reviewing AI-generated SQL or an unfamiliar Supabase starter.
- Separating tenant, organization, or per-user data in a multi-tenant app.
- Investigating whether a public client can cross a row-ownership boundary.
- Preparing a focused human review after a Security Advisor warning.
Permissions and safety boundary
- Terminal and file-read permissions support the local scanner.
- Read-only inspection comes first; the scanner installs nothing and transmits nothing.
- It does not connect to a live Supabase project or change policies, grants, buckets, or settings.
- Any write, install, deploy, delete, reset, live-account action, payment, or external lookup requires separate confirmation.
- Do not paste live database credentials or elevated key values into an agent conversation.
Known limitations
The scanner is heuristic. It can identify risky patterns and missing local evidence, but it cannot prove a schema is secure or determine whether a deliberately public policy matches the product's business rules. Project-level settings, deployed drift, Security Advisor state, runtime JWT claims, and role-by-role behavior require manual or user-approved live testing.
Views, security-definer functions, grants, storage behavior, and authorization encoded outside matching files may need direct review. Treat a clean result as a smaller review queue, not a certification.
Use the Supabase RLS pre-launch checklist to build the identity-operation matrix and live evidence the local scan cannot see.
// choose with context
Is Supabase RLS Doctor the right skill?
It returns
Local, read-only findings on RLS policies, authentication checks, service-role key exposure, storage access, grants and migration drift. It does not certify the deployed project.
Do not use it as
Do not treat a successful run as proof beyond the supplied files, declared scope, and evidence the skill actually checked.
Compatibility, access, version, and licence
- Reads or accesses
- Only the files or context you deliberately provide; review the listing before granting additional access.
- Compatibility
- Agents that read the open SKILL.md format. Verify runtime and service requirements at the purchase or install destination.
- Version
- Verify the current package version at the linked destination.
- Licence
- Review the package licence and seller terms at the linked destination.
Questions
What Supabase security problems can it flag?
It flags missing or disabled RLS, apparently permissive policies, missing ownership checks, elevated-key references in frontend code, storage review targets, overbroad grants, and migration drift.
What project evidence can it inspect?
SQL migrations and policy files, Supabase client initialization code, database schema snapshots, and storage policy configuration. Declared scopes include matching SQL and migration files.
Does it connect to or modify my live project?
No. The scan is local and read-only. It does not change policies or settings, transmit project data, or install dependencies.
What does the report contain?
Severity-ranked findings with exact local evidence, impact, a suggested remediation, and a verification step, plus a manual review checklist.
Can it verify Dashboard and Security Advisor settings?
Not without separately approved live access. Deployed settings and role behavior require manual or user-approved testing.
Does a clean scan prove the database is secure?
No. It is a heuristic review tool, not a security certification. Test the intended authorization model by role and operation before launch.
Add Supabase RLS Doctor to your pre-launch review.
Current price and purchase option are shown on Agensi. The workflow starts read-only and works with agents that load SKILL.md packages.
Get Supabase RLS Doctor on Agensi