Free Supabase RLS Checker
Is my Supabase database public?
Supabase serves every table through PostgREST, and the anon key that reaches it ships inside your public JavaScript - so a table with no Row Level Security policy is readable by anyone with DevTools open. This checker lifts that anon key out of your own bundle, tries to read common tables with it, and tells you which ones answered.
What this checker looks at
Supabase project URL and anon key in your bundle
Downloads the JavaScript your page links to and extracts the Supabase project URL and publishable anon key it ships with.
Read more →Tables readable without auth
Sends ordinary PostgREST reads for common table names - users, profiles, orders, payments, subscriptions, customers, transactions, invoices, accounts - carrying only that public key.
Read more →Public storage buckets
Checks whether your Supabase Storage buckets list or hand back objects to an unauthenticated request.
RPC functions callable without auth
Calls common Postgres functions exposed at /rest/v1/rpc to see which ones execute for an anonymous caller.
Service-role key shipped to the browser
Flags a service_role key or JWT secret found in client-side code. That key ignores RLS completely, so a policy audit will not save you if it leaked.
Read more →Everything else on the same run
The scan also checks security headers, TLS, exposed .env files and source maps, CORS, and cookie flags - an RLS gap is rarely the only thing open.
Read more →How the Supabase RLS Checker works
- Step 1
Paste your app URL
Your live URL is the only input. No Supabase login, no database password, no service-role key, no GitHub access, and no Ubserve account.
- Step 2
We read what your visitors can read
We fetch the page, download the JavaScript bundles it references, pull out the Supabase project URL and anon key, then issue normal PostgREST reads against common tables, storage buckets, and RPC functions using nothing but that public key. If a row comes back to us, RLS is not stopping a stranger either.
- Step 3
You get the report, partially unlocked
You see the issue count, a letter grade, and up to two findings in full, free. The rest - including the highest-severity findings and the copy-paste fix prompts - unlocks with a one-time report unlock or a plan.
Frequently asked questions
How do I know if my Supabase database is public?
Open your deployed app, look in DevTools for your Supabase project URL and anon key, then request a table directly: GET https://YOUR-PROJECT.supabase.co/rest/v1/profiles?select=* with that key as the apikey header. If rows come back, that table has no Row Level Security policy blocking anonymous reads, and anyone who views your site can do exactly the same thing. This checker automates that test across the table names that ship most often.
What is Row Level Security?
Row Level Security (RLS) is a Postgres feature that decides, row by row, who is allowed to select, insert, update, or delete. Supabase exposes your tables over HTTP through PostgREST, so RLS is the only thing standing between a table and the public internet. Enabling RLS on a table with no policies denies everything; enabling it with a policy like auth.uid() = user_id lets each signed-in user reach only their own rows. A table with RLS switched off is readable by anyone holding the anon key - and the anon key is in your JavaScript by design.
How does the checker work?
It runs the standard Ubserve public scan. We fetch your URL, download the JavaScript bundles the page links to, and extract the Supabase project URL and anon key from them. Using only that public key, we send read requests for common table names, check storage buckets for unauthenticated listing, and call common RPC functions. We record the HTTP status and whether data came back. Nothing is written, modified, or deleted - every probe is a read.
Is it free? Do I need to sign in?
The scan is free and you do not need an account to run it. You get the issue count, a letter grade, and up to two findings shown in full - location, evidence, and severity - at no cost. The rest of the report stays locked, including the highest-severity findings and the copy-paste fix prompts you can hand to your AI coding tool. Unlocking everything is a one-time payment for that report, or a plan if you want repeat scans and monitoring.
Does Ubserve see my service-role key, database password, or source code?
No. This scan only reads what your app already serves to the public: the HTML at your URL, the JavaScript bundles that page links to, HTTP response headers, TLS certificate details, and public DNS records. We never ask for a repository, a database password, a service-role key, or an app login, and we cannot see private source code or authenticated pages. When we find a secret in your bundle, we found it because your browser downloads it too - anyone viewing your site can read the same bytes.
How is this different from reviewing my RLS policies by hand?
A policy review tells you what you intended; this tells you what your deployed app actually answers. The two disagree more often than founders expect - a policy can exist on a table but be permissive, RLS can be enabled on the table you remembered and not the view beside it, and a leaked service-role key bypasses every policy you wrote. Reading the response your own anon key gets is the check that cannot be fooled by intent. We wrote up the wider trade-off between automated scanning and hand review on its own page.
What founders say
5.0 out of 5 - Ubserve, from 3 reviews
“Helped me find a critical database issue that would've done real damage. I recommend it for every founder.”
“Caught a critical CSP issue on my frontend within minutes. Don't ship without a scan.”
“The free scan took under 60 seconds to find real issues in my project.”
Other free tools
See all tools →Exposed API Key Scanner
Downloads your deployed JavaScript and matches it against key patterns for 30+ providers, from Stripe to OpenAI to AWS.
Open tool →
AI BuildersLovable Security Scanner
Checks a published Lovable app for the defaults it ships with: open Supabase tables, keys in the bundle, and ungated routes.
Open tool →
DatabaseFirebase Rules Checker
Finds the Firebase config in your bundle and tests whether your Realtime Database answers an unauthenticated read.
Open tool →Keep reading
- Supabase security checklist for AI-built appsThe full pre-launch pass over RLS, auth, storage, and keys.
- What is Row Level Security?The concept in plain language, with policy examples.
- How to fix missing RLS in SupabaseThe SQL to enable RLS and write policies that hold.
- Supabase RLS not working? Here's whyThe usual reasons a policy exists but protects nothing.
- Ubserve vs manual security reviewWhere hand review wins, and where it quietly misses.
Run the Supabase RLS Checker
Paste your URL and see what your app is handing to the public. Free, no account, no repo access.