Audit public tables, service role leakage, and missing Row-Level Security (RLS) policies on your Supabase backend.
Tests REST PostgREST schemas for public SELECT/UPDATE permissions, inspects anonymous role access, and validates database auth policies.
Canonical test payload dispatched during security surface audits.
GET /rest/v1/users?select=* (returns all rows with anon key)Watch the probe engine test this signature in an isolated sandbox.
Enable Row-Level Security
CREATE TABLE profiles (id uuid, email text); -- RLS disabled
ALTER TABLE profiles ENABLE ROW LEVEL SECURITY; CREATE POLICY "Users can view own profile" ON profiles FOR SELECT USING (auth.uid() = id);
Always enable RLS on every public PostgreSQL table and configure granular policies mapped to auth.uid().
Copy and paste into your editor to refactor this issue automatically.
Test your public domain specifically for BaaS & Supabase RLS Policy Auditor.
Checks commonly evaluated alongside BaaS & Supabase RLS Policy Auditor during surface discovery.
Detect SQL injection vulnerabilities in your web application before attackers exploit database access.
Find XSS vulnerabilities that could let attackers inject malicious scripts and steal customer sessions.
Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.
Audit your site across all 41 vectors automatically on every deploy.