Supabase Security Scanner

Supabase powers thousands of production apps, but its permissive defaults can leave your data wide open. Our scanner checks Row Level Security policies, exposed REST and Realtime endpoints, auth configuration, storage bucket permissions, and edge function security to ensure your Supabase backend is locked down.

What This Scanner Does

Connects to your Supabase project and analyzes RLS policies on all tables, checks for publicly accessible data through the REST API, verifies auth settings (email confirmation, MFA enablement), audits storage bucket policies, and tests edge function authentication requirements.

Why It Matters

Supabase exposes a public REST API by default, and without proper RLS policies, any authenticated (or anonymous) user can read, modify, or delete data from any table. This is the #1 security mistake in Supabase projects and has led to numerous data breaches in production applications.

Common Findings

• Tables missing Row Level Security policies
• RLS enabled but no policies defined (blocks all access)
• Anon key used with overly permissive RLS rules
• Storage buckets with public read/write access
• Email confirmation not required for signups
• Service role key exposed in client-side code

OWASP Top 10 Coverage

Related Security Checks