Supabase security review

A human security review of your Supabase app, in 48 hours.

Your AI-built app talks straight to your database. This review answers the question your launch checklist keeps deferring: can strangers read or change data they should not? You get ranked findings, the exact SQL to close each one, and a proof you can re-run yourself.

Book a security review See what a Ship Check covers

Not ready to talk? Run the free RLS check first it runs in your browser, your SQL never leaves the page.

What it is

A Supabase security review is a human audit of everything standing between your users data and the open internet: RLS policies, exposed keys, storage rules, auth configuration, and service-role usage. You receive a ranked report with corrected SQL and a re-runnable proof for every finding, delivered within 48 hours.

What gets reviewed

The six places Supabase apps actually leak.

Not a generic scanner checklist. These are the failure modes specific to apps where the frontend talks directly to Postgres.

01

Row Level Security policies

Every table, every policy. USING (true) on user data, writes with no WITH CHECK, policies that let any signed-in user read every row, and tables where RLS was never switched on at all.

02

Key exposure

Which keys ship in your client bundle, and what they can actually do. The anon key is meant to be public; the question is what your policies let it reach.

03

Storage rules

Bucket policies on storage.objects. Can strangers list your buckets, read private files, upload whatever they like, or overwrite what your users uploaded?

04

Auth configuration

Signup settings, redirect URLs, email confirmation, and whether the checks your UI performs are also enforced on the server, where they actually count.

05

Service-role usage in client code

The service-role key bypasses all RLS. We check your bundle, API responses, and error messages for it, and flag any client path that quietly runs with full database access.

06

API surface

Edge functions and API routes. Which endpoints trust whatever the caller sends, accept arbitrary IDs, or leak other users’ data through responses and error messages.

What you receive

Triage is the product, not the scan.

Anyone can hand you a findings list. The value is a human deciding which three of the forty matter this week, and giving you the SQL to close them.

01
A ranked, triaged report
Not a 40-item dump. Findings sorted into what is exposed right now, what is urgent, and what can wait, so you know exactly where to start.
02
Corrected SQL for every finding
The exact policy or statement to run, written for your schema. Not "consider hardening your RLS". You can paste most fixes straight into the SQL editor.
03
A proof you can re-run
Each finding carries the query or request that demonstrated it. Run it yourself before the fix and after, and watch the door close.
Where to start

Start free. Escalate only as far as your findings demand.

Free
RLS Checker

Paste your schema, get a triaged read on your policies in seconds. It runs entirely in your browser, your SQL never leaves the page. Start here.

Run the free check

The review
Ship Check

The productized security review this page describes. $299 flat, delivered within 48 hours: ranked findings, corrected SQL, a proof per finding.

See what a Ship Check covers

The fix
Ship Fix

When the report surfaces more than you want to fix alone, we do the remediation. Scoped from the findings, typically $4K to $15K depending on how deep it goes.

How Ship Fix works

Ongoing
Continuum Watch and Care

Once it is clean, keep it that way. Watch from $49/mo monitors for regressions; Care from $500/mo adds a human on retainer for whatever comes next.

Keep it covered

Who this is for

You shipped fast. Now there are real users in the database.

This review is built for founders who vibe-coded an app with Lovable, Bolt, Cursor, v0, or Replit, wired it to Supabase, and got traction. Those tools write working features far faster than they write correct security policies, and the gap does not show up in testing. It shows up when a stranger points a REST client at your project URL. If your app has real users, real signups, or real payments, and nobody with security experience has ever read your policies, this is the review that closes that gap before someone else finds it.

built with Lovablebuilt with Boltbuilt with Cursorbuilt with v0built with Replit
FAQ

Straight answers about the review.

Enabled is not the same as correct. RLS switched on with a USING (true) policy behind it is exactly as open as RLS switched off. The most serious exposures we see are on tables where RLS was technically enabled: policies that let any signed-in user read every row, INSERT policies with no WITH CHECK, storage buckets readable by anyone. The review tests what your policies actually allow, not whether the toggle is on.
Your live app URL, plus read access to your schema and policies: either a supabase db dump output or a read-only invite to your Supabase project. The review is read-only; we do not modify your project or your data. We never ask you to paste your service-role key into a chat or email. If you cannot grant project access, a schema dump plus the live URL covers most of the review.
A traditional penetration test is scoped over weeks, priced in five figures, and produces a compliance-grade document. This review is built to answer one question fast: can a stranger, or another one of your users, read or change data they should not? It concentrates on the failure modes specific to Supabase apps, RLS, keys, storage, and auth configuration, and every finding ships with corrected SQL, not just a vulnerability writeup. If you need a formal pen test for an enterprise deal or a compliance framework, this is not that, and we will tell you so upfront.
48 hours from the moment we have access. Agent tooling does the overnight volume across your policies, bundle, storage, and API surface; a human engineer spends the next day verifying each candidate finding against your live app and ranking what is real. You get the report, the corrected SQL, and the proofs together.
You hear about it immediately, not in the final report. If data is exposed right now, we send you the finding, the proof, and the immediate stopgap, usually a single SQL statement or a key rotation, the moment it is confirmed. The full ranked report follows with everything else.
A human engineer with 20+ years shipping production software, aided by agent tooling that handles the volume work. The agents surface candidates; the human reproduces each one against your app, throws out the noise, and makes the severity call. Nothing lands in your report without a human having verified it.

Know what is exposed before someone else does.

A 20-minute call scopes the review. 48 hours later you know exactly where you stand, with the SQL to fix it.

Book a security review See what a Ship Check covers

or start with the free RLS check, no signup, runs in your browser