Guides
What actually goes wrong with Supabase Row Level Security, why it goes wrong more often when an AI wrote the migration, and the SQL that fixes each case.
Prevent Supabase RLS bypass
4 rulesFind tables with Row Level Security disabled, policies that evaluate to true, and writes with no WITH CHECK — then keep them from coming back.
Detect a service_role key in your client bundle
1 ruleThe service_role key bypasses RLS entirely. Find it in your deployed JavaScript before someone else does — free, no signup, no code access needed.
Why your Supabase bill spikes after adding RLS
2 rulesUnindexed RLS predicates and bare auth.uid() calls turn every query into a sequential scan. Find both, with the SQL to fix them.
Check whether your Lovable app is leaking data
3 rulesFree, no-signup check for tables readable with your public anon key, RLS switched off, and service_role keys in the bundle.
Bolt.new shipped tables without RLS
3 rulesFind every table Bolt created without Row Level Security, and get the enable-plus-policy SQL generated from your real columns.
Audit the Supabase policies Cursor wrote
3 rulesCursor writes plausible RLS. Check for policies that evaluate to true, writes without WITH CHECK, and predicates with no index.
Detect Supabase schema drift after migrations
4 rulesKnow when a table appears without policies, a policy is rewritten, RLS is switched off, or a bucket flips to public — and when a fix regresses.
SECURITY DEFINER views and functions that bypass RLS
manual checkA SECURITY DEFINER view runs as its owner and ignores the caller RLS policies. Here is how to find them yourself, with the catalog queries.
What the Supabase Security Advisor does not do
7 rulesThe advisor is a point-in-time check you have to open. Continuous scanning, drift diffing, alerts and CI exit codes are what it is missing.
Continuous RLS monitoring for Supabase
7 rulesScheduled catalog audits, drift diffing, Slack and webhook alerts on transitions, and CI exit codes. From $19/mo.