Supabase security audit

Sound familiar?

• You built on Supabase with an AI tool and never checked the security settings.
• The dashboard says RLS is on, but you’ve never tested what a logged-out user can read.
• Your app hides admin pages in the browser, and you’re not sure the database agrees.
• A client asked how their data is protected and you didn’t have an answer.

What you get

• Every table checked for row level security, with a policy that actually checks who’s asking. A policy that allows everything is the same as no policy.
• A search of your built app for secret keys that shipped to the browser.
• A test of whether swapping an ID in a URL shows someone else’s data.
• A check that payments are confirmed by the server, not by the browser.
• A findings report: what’s exposed, where, how serious it is. A clear fix for each finding, with exact steps once we have code access.

How it works

The first pass runs from the outside with no access needed, and the findings report comes back within 48 hours. You can fix the issues yourself from the report, or have us fix them at a fixed price. If we find something serious, you hear about it straight away rather than at the end. The first pass is the free production diagnosis.

Questions

Isn’t RLS turned on by default in Supabase?

Only for tables created in the Table Editor. Tables created by SQL, migrations or an AI tool don’t get it automatically, and that’s where most leaks come from.

What if the audit finds nothing?

Then you have a written report of what the free review tested and found nothing in from the outside. If you want deeper coverage, including everything that needs code access, that’s the code-access review and fix work described above.

Do you fix the issues too?

Yes, if you want. The report lists every fix, so you can also hand it to your own developer.