Skip to content
SlashClone
DiscoverUse in ClaudeSubmit a link
Sign in
Made by@shipcheck

Supabase rls audit

@shipcheck/supabase-rls-audit

Audit row level security in your Supabase migrations before you launch. Finds tables with RLS off, policies that let anyone write, policies that trust user_metadata, views that skip RLS, and risky SECURITY DEFINER functions, then drafts a fix migration for you to review. Reads .sql files only and never touches your database.

SkillDevOpsv1.0.0 (latest)Tested
Use in Claude Save Like Clone Comment
Activity
New: be the first to try it
  1. 1# Supabase RLS audit
  2. 2
  3. 3Checks the row level security in your Supabase migrations and tells you, in plain words, who can read or change each table. Then it drafts a fix migration for you to review, so you can launch without leaving your data open to anyone holding your public anon key.
  4. 4
  5. 5**For:** anyone shipping a Supabase app, especially your first one. No security background needed.
  6. 6
  7. 7## Example
  8. 8
  9. 9Input: `supabase/migrations/` with a table that never got `enable row level security` and a policy like `for all to authenticated using (auth.role() = 'authenticated')`.
  10. 10
  11. 11Output (`out/rls-audit.md`):
  12. 12
  13. 13```markdown
  14. 145 tables, 4 with RLS on.
  15. 15High: 3 | Medium: 4 | Low: 0 | Info: 1
  16. 16
  17. 17## High
  18. 18- public.invoices (rls-disabled): Row level security is off. Anyone with your
  19. 19 public anon key can read and change every row through the API.
  20. 20 - Fix: alter table public.invoices enable row level security;
  21. 21- public.notes / Signed in users can do anything (policy-any-user-write):
  22. 22 any user can read and change other users' rows.
  23. 23```
  24. 24
  25. 25Plus `out/rls-fixes.sql`, a draft migration with one commented fix per finding. Try it on the bundled example: `node scripts/rls-audit.mjs examples/migrations`.
  26. 26
  27. 27## What it checks
  28. 28
  29. 29Tables with RLS off, `USING (true)` and `WITH CHECK (true)` policies, policies that only check "signed in", policies that trust `user_metadata`, views without `security_invoker`, materialized views, and SECURITY DEFINER functions without a fixed `search_path`.
  30. 30
  31. 31## What it can access
  32. 32
  33. 33- Reads `supabase/migrations/**` (and `supabase/schema.sql` if you paste one).
  34. 34- Writes the report to `out/`, and a new fix migration to `supabase/migrations/` only after you say yes.
  35. 35- Runs only its own script. No network, no database connection, no env vars.
  36. 36
  37. 37## Setup
  38. 38
  39. 39None. Needs Node 22 or later.
Sign in to comment on a line