supabase rls policy auditor

The problem

Supabase RLS policies often look correct while still leaking data due to permissive policy overlap or incorrect scoping columns. Relying on a visual audit of policy text is insufficient for identifying IDOR/BOLA vulnerabilities in a production database.

What it does

• Audits every table in a Supabase or Postgres project against an IDOR/BOLA attack matrix.
• Identifies missing RLS, overly permissive policies, and unsafe usage of user-editable JWT metadata.
• Generates precise remediation SQL including DROP, ALTER, and CREATE POLICY statements using hardened null-check patterns.
• Verifies fixes by generating and executing cross-tenant queries to prove enforcement rather than just reviewing code.
• Scans for service_role key leakage in client-side environment variables and source code.

Frameworks & tools

PostgreSQL, Supabase, and RLS (Row Level Security) mechanics.

Why this beats prompting it yourself

Generic LLMs often miss that Postgres combines permissive policies with OR, meaning adding a correct policy won't fix an existing leak. This skill enforces a "verify via query" workflow, ensuring you don't just feel safe, but are actually protected against cross-tenant access.

Use cases

• Reviewing Supabase-backed applications before moving from staging to production.
• Auditing legacy projects where RLS was applied inconsistently across different teams.
• Fixing data leaks where one table's policy inadvertently grants access to another tenant's rows.
• Validating that service_role keys are not exposed to the frontend or public mobile bundles.

Known limitations

Does not perform broad security audits like secrets scanning or logging. Verification queries require a connection that does not bypass RLS (non-superuser role).