How much does it cost?

Indie is $19/month for 3 projects at hourly scans. Team is $49/month for 15 projects at 15-minute scans with Discord and custom webhooks. Findings and remediation SQL are never withheld by plan.

What access does it need?

A Postgres connection string for the project you want monitored. Grant it catalog read access only; it never selects from your tables.

The scanner, probe and CLI run anywhere Node runs, against any connection string, with no VibeGuard service involved.

Guides

Continuous RLS monitoring for Supabase

One audit tells you about today. Continuous monitoring tells you the moment today stops being true — which, on a codebase where an AI writes the migrations, is roughly every deploy.

Rules that check this

criticalRow Level Security disabledRLS_DISABLED
highRLS enabled but no policiesRLS_NO_POLICIES
criticalPolicy always evaluates to trueRLS_TAUTOLOGY
highWrite policy without WITH CHECKMISSING_WITH_CHECK
mediumRLS predicate column is not indexedUNINDEXED_RLS_PREDICATE
highStorage bucket is publicPUBLIC_BUCKET_EXPOSURE
mediumauth.uid() not wrapped in a subqueryRLS_UNWRAPPED_AUTH_CALL

How a scan works

Each run takes one catalog snapshot and evaluates every rule as a pure function over it. That means a scan is a fixed number of round-trips regardless of rule count, and a new rule can be replayed over stored snapshots before it is switched on for alerting.

Findings are then diffed against the previous run and classified as new, regressed, or resolved.

From the terminal, and from CI

The same engine runs as a CLI against any connection string, printing the findings and the generated SQL.

npx vibeguard scan --db-url "$DATABASE_URL" --fail-on high --sql

Alerts worth reading

Alerts fire on transitions only, with a severity threshold per destination. A project broken for a week pages you once, and a medium-severity index finding does not wake anybody.

Frequently asked

How much does it cost?: Indie is $19/month for 3 projects at hourly scans. Team is $49/month for 15 projects at 15-minute scans with Discord and custom webhooks. Findings and remediation SQL are never withheld by plan.
What access does it need?: A Postgres connection string for the project you want monitored. Grant it catalog read access only; it never selects from your tables.
Can I self-host it?: The scanner, probe and CLI run anywhere Node runs, against any connection string, with no VibeGuard service involved.

Check your project in about ten seconds

Paste a URL. No signup, no writes, nothing stored.

Run the free audit