Supabase RLS Doctor
Audit local Supabase migrations and client code for the row-level-security mistakes that can expose data, with severity, exact evidence, and a verification step for every review target.
What it inspects
- Tables with missing or disabled row-level security.
- Policies that appear to grant broad anonymous or authenticated access.
- Missing
auth.uid()ownership checks on user-scoped data. - Secret or legacy
service_rolekey references in frontend initialization. - Storage bucket policies, ownership rules, and public-access review targets.
- Overbroad grants and multi-tenant ownership conditions.
- Migration and schema evidence that may not match the intended deployed state.
What you give it
Point the workflow at the local project evidence you want reviewed: SQL migrations and policy files, Supabase client initialization code, a database schema snapshot, and storage policy configuration. Declared file scopes include its own package, matching *.sql files, and supabase/migrations/*.
The scanner uses the Python 3 standard library. If Python or matching files are unavailable, the skill falls back to its manual checklist instead of inventing a result.
What comes back
The local scanner prints Markdown or JSON findings. Each finding is ranked from Critical to Info and includes the affected object or file, exact review evidence, impact, a proposed fix, and a verification step. The checklist then covers policy semantics and live-project boundaries the heuristic scan cannot prove.
USING (true) for public intentUseful before
- Launching a Supabase-backed web or mobile app.
- Merging a migration that adds a table, policy, view, function, or storage rule.
- Reviewing AI-generated SQL or an unfamiliar Supabase starter.
- Separating tenant, organization, or per-user data in a multi-tenant app.
- Investigating whether a public client can cross a row-ownership boundary.
- Preparing a focused human review after a Security Advisor warning.
Permissions and safety boundary
- Terminal and file-read permissions support the local scanner.
- Read-only inspection comes first; the scanner installs nothing and transmits nothing.
- It does not connect to a live Supabase project or change policies, grants, buckets, or settings.
- Any write, install, deploy, delete, reset, live-account action, payment, or external lookup requires separate confirmation.
- Do not paste live database credentials or elevated key values into an agent conversation.
Known limitations
The scanner is heuristic. It can identify risky patterns and missing local evidence, but it cannot prove a schema is secure or determine whether a deliberately public policy matches the product's business rules. Project-level settings, deployed drift, Security Advisor state, runtime JWT claims, and role-by-role behavior require manual or user-approved live testing.
Views, security-definer functions, grants, storage behavior, and authorization encoded outside matching files may need direct review. Treat a clean result as a smaller review queue, not a certification.
Use the Supabase RLS pre-launch checklist to build the identity-operation matrix and live evidence the local scan cannot see.
Questions
What Supabase security problems can it flag?
It flags missing or disabled RLS, apparently permissive policies, missing ownership checks, elevated-key references in frontend code, storage review targets, overbroad grants, and migration drift.
What project evidence can it inspect?
SQL migrations and policy files, Supabase client initialization code, database schema snapshots, and storage policy configuration. Declared scopes include matching SQL and migration files.
Does it connect to or modify my live project?
No. The scan is local and read-only. It does not change policies or settings, transmit project data, or install dependencies.
What does the report contain?
Severity-ranked findings with exact local evidence, impact, a suggested remediation, and a verification step, plus a manual review checklist.
Can it verify Dashboard and Security Advisor settings?
Not without separately approved live access. Deployed settings and role behavior require manual or user-approved testing.
Does a clean scan prove the database is secure?
No. It is a heuristic review tool, not a security certification. Test the intended authorization model by role and operation before launch.
Add Supabase RLS Doctor to your pre-launch review.
Current price and purchase option are shown on Agensi. The workflow starts read-only and works with agents that load SKILL.md packages.
Get Supabase RLS Doctor on Agensi