Answers / Supabase row level security

Best Supabase RLS checker

Matt Turley, Continuum. Updated 5 November 2026.

The short answer

Best Supabase RLS checker

Start with the Supabase Security Advisor, because it reads your real project and flags tables with row level security switched off. Then prove each policy works with pgTAP tests run as real roles, and use a paste-in checker or an outside scan for a second opinion.

How we compared them

We make a free RLS checker and a Leak Check at Continuum, so we say where Supabase’s own tools do a better job.

An RLS check can mean reading your policy text, testing the policies as a user, or probing your live database from outside. Each option was weighed on:

  • What it looks at: policy text, a live project or real requests.
  • Whether it tests behaviour or only reads settings.
  • What it takes to run it and who can read the result.
  • What it cannot see.

The options

Options are listed from the one built into Supabase outward, which is not a ranking. Facts about Supabase come from the sources at the bottom.

Supabase Security Advisor

Supabase’s own linter

The advisors are checks that ship with the platform. You can open them in the dashboard, run them from the CLI with supabase db advisors, or call them through the MCP server. The Security Advisor flags tables that have row level security switched off, and Supabase emails project owners when a table is created that way.

Good at
It reads your real project, so it sees what the other options can only guess at.
Fits
Every Supabase project, run before launch and after schema changes.
Drawbacks
Supabase notes that some findings may be intentional, so each one needs a decision. The finding in its docs is about row level security being off. A policy that is on but too wide, such as one that lets everyone read a table, is a separate question that you test.

Sources: [1]

pgTAP tests with supabase test db

Automated tests that run as a user

pgTAP is a Postgres testing framework. Supabase’s guide has you write a test file for each table you secure, switch to the anon or authenticated role with set local role, set the user ID, and check which rows come back or which error is raised. Then you run supabase test db.

Good at
It proves a policy does what you meant and keeps proving it after later changes. Supabase suggests asserting that one user cannot read, update or delete another user’s rows.
Fits
A developer on the team, or one hired to write the tests.
Drawbacks
Someone has to write the tests. Supabase warns that a check against the pg_policies view can pass while the policy is still wrong, so the tests should assert on the rows returned.

Sources: [2]

Dashboard RLS Tester

Run a query as a user, in the dashboard

Supabase announced an RLS Tester as a feature preview. It uses role impersonation to run SQL as a chosen user and show which policies applied.

Good at
You can try a policy as a user without leaving the dashboard.
Fits
Someone debugging one policy by hand.
Drawbacks
It was announced as a preview, and we could not confirm it is available on every project. Check your own dashboard before you plan around it.

Sources: [3]

Continuum RLS checker and Leak Check

Paste in your SQL, or probe the live app

The RLS checker is free and runs in your browser. You paste a schema dump, CREATE POLICY statements or pg_policies output. It then checks eight things: tables with RLS off, RLS on with no policies, wide-open read rules on sensitive tables, permissive write rules, anonymous writes, comparisons against a null user ID, security definer functions with no search path, and open storage rules. The free Leak Check also asks from outside whether public tables answer without a login.

Good at
Nothing is uploaded and no account is needed. Each finding comes with corrected SQL in plain words.
Fits
A founder or non-specialist who wants a readable second opinion on policy text.
Drawbacks
The checker reads text you paste with a heuristic SQL parser, so it cannot see your live data or grants, and unusual SQL can be misread. It does not run your policies as a user, which is what pgTAP does.

Open the free RLS checker →

Which one fits which need

Pick by the job. This is not a ranking.

Which option fits which need, for: best supabase rls checker.
Which option fits which need, for: best supabase rls checker.
If you need toLook at
Find tables with RLS switched off in a live projectSupabase Security Advisor.
Prove one user cannot reach another user’s rowspgTAP tests run as the anon and authenticated roles.
Try one policy as a user, by handThe dashboard RLS Tester, if your project has it.
A readable second opinion on policy SQL, without sharing itContinuum’s paste-in RLS checker.
See what a stranger can read from outsideAn outside scan such as the free Leak Check.

Why this check is worth ten minutes

Supabase’s own docs say a table in an exposed schema without row level security is readable and writable by any role with a grant on it (source 4).

Continuum scanned 500 live apps built with Lovable, Bolt and base44 in October 2026. 177 of them ran on Supabase, and 31 of those 177 (17.5%) had at least one table that returned a row to a request with no login. 8 of the 177 (4.5%) had a table holding clearly non-public records. [6] Method and data.

That is the case an RLS check exists to catch, and it is the one most likely to hurt real users.

Get a second opinion on your policies

Paste your schema into the free RLS checker, and nothing leaves your browser. If you would rather have a person read the whole Supabase setup, that is the Supabase security review. Open the free RLS checker →
Book a call →See all services and prices →
FAQ

Straight answers

What is the best way to check Supabase RLS policies?
Use more than one. Run the Security Advisor to find tables with RLS off, write pgTAP tests that run as the anon and authenticated roles to prove each policy, and read your live app from outside as a final check.
Is it safe to expose the Supabase anon key?
The anon key is not a secret, but it only protects anything when row level security and narrow grants sit behind it. Supabase maps every key to a database role, and the service role key bypasses RLS entirely, so it must stay on the server.
Does turning on RLS make my data private?
Turning RLS on with no policies blocks API access for the publishable key until you write them, according to Supabase’s docs. A policy written too widely can open the table again, which is why you test the policies and not just the switch.
Can one tool find every RLS problem?
No. Tools that read policy text miss what only a live request reveals, outside scans can only probe what they can reach, and tests cover only the cases someone wrote. Use a mix.
Keep reading
Supabase security reviewA human review of your Supabase setup, with what it covers.Is my Supabase secure?The common ways a Supabase project ends up readable.Best AI app security checkThe wider set of checks, and the order to run them in.Can I expose this key?Is the key in your front end meant to be there?Supabase auth not workingWhy login fails, and why switching RLS off to fix it is the wrong move.
Sources
  1. 1. Performance and Security Advisors, Supabase Docs, Supabase, checked 2026-11-05: Where the advisors run, the RLS-disabled finding, email alerts, and the note that some findings may be intentional.
  2. 2. Test Row Level Security policies with pgTAP, Supabase Docs, Supabase, checked 2026-11-05: Writing tests that run as anon or authenticated, asserting one user cannot reach another’s rows, and the warning about checking pg_policies.
  3. 3. Feature Preview: RLS Tester, Supabase Changelog, Supabase, checked 2026-11-05: The dashboard RLS Tester, announced as a feature preview that uses role impersonation.
  4. 4. Row Level Security, Supabase Docs, Supabase, checked 2026-11-05: A table in an exposed schema without RLS is readable and writable by any role with a grant, and what enabling RLS does until policies exist.
  5. 5. API keys, Supabase Docs, Supabase, checked 2026-11-05: Each key maps to a database role. The service role bypasses RLS and belongs on the server.
  6. 6. AI-Built App Database Exposure Scan, October 2026, Continuum, published 2026-10-10: Continuum’s own study: sample size, method, denominators and the downloadable data.
Best Supabase RLS checker | Continuum