A human security review of your Supabase app, in 48 hours.
Your AI-built app talks straight to your database. This review answers the question your launch checklist keeps deferring: can strangers read or change data they should not? You get ranked findings, the exact SQL to close each one, and a proof you can re-run yourself.
Not ready to talk? Run the free RLS check first → it runs in your browser, your SQL never leaves the page.
What it is
A Supabase security review is a human audit of everything standing between your users’ data and the open internet: RLS policies, exposed keys, storage rules, auth configuration, and service-role usage. You receive a ranked report with corrected SQL and a re-runnable proof for every finding, delivered within 48 hours.
The six places Supabase apps actually leak.
Not a generic scanner checklist. These are the failure modes specific to apps where the frontend talks directly to Postgres.
Row Level Security policies
Every table, every policy. USING (true) on user data, writes with no WITH CHECK, policies that let any signed-in user read every row, and tables where RLS was never switched on at all.
Key exposure
Which keys ship in your client bundle, and what they can actually do. The anon key is meant to be public; the question is what your policies let it reach.
Storage rules
Bucket policies on storage.objects. Can strangers list your buckets, read private files, upload whatever they like, or overwrite what your users uploaded?
Auth configuration
Signup settings, redirect URLs, email confirmation, and whether the checks your UI performs are also enforced on the server, where they actually count.
Service-role usage in client code
The service-role key bypasses all RLS. We check your bundle, API responses, and error messages for it, and flag any client path that quietly runs with full database access.
API surface
Edge functions and API routes. Which endpoints trust whatever the caller sends, accept arbitrary IDs, or leak other users’ data through responses and error messages.
Triage is the product, not the scan.
Anyone can hand you a findings list. The value is a human deciding which three of the forty matter this week, and giving you the SQL to close them.
Start free. Escalate only as far as your findings demand.
Paste your schema, get a triaged read on your policies in seconds. It runs entirely in your browser, your SQL never leaves the page. Start here.
The productized security review this page describes. $299 flat, delivered within 48 hours: ranked findings, corrected SQL, a proof per finding.
When the report surfaces more than you want to fix alone, we do the remediation. Scoped from the findings, typically $4K to $15K depending on how deep it goes.
Once it is clean, keep it that way. Watch from $49/mo monitors for regressions; Care from $500/mo adds a human on retainer for whatever comes next.
You shipped fast. Now there are real users in the database.
This review is built for founders who vibe-coded an app with Lovable, Bolt, Cursor, v0, or Replit, wired it to Supabase, and got traction. Those tools write working features far faster than they write correct security policies, and the gap does not show up in testing. It shows up when a stranger points a REST client at your project URL. If your app has real users, real signups, or real payments, and nobody with security experience has ever read your policies, this is the review that closes that gap before someone else finds it.
Straight answers about the review.
Know what is exposed before someone else does.
A 20-minute call scopes the review. 48 hours later you know exactly where you stand, with the SQL to fix it.
or start with the free RLS check, no signup, runs in your browser