Your AI wrote the schema.
Nobody wrote the policies.
Paste your deployed URL. RowShield checks what your public anon (publishable) key can actually read and whether a service_role key is in your bundle — no account, GET, HEAD and OPTIONS requests only, under ten seconds, nothing stored.
Run a free read-only audit
Paste a deployed app URL. No account or database writes required. The free check tests two things: which tables the public anon key can read, and whether a service_role key is in the bundle. The nine-rule audit runs once a project is connected.
The URL check is free. Continuous monitoring starts at $29/month, only when you turn it on — nothing is billed before that. See the plans
Connected audit — sample project
| table_name | rls_enabled | row_filter | status |
|---|---|---|---|
| invoices | off | service_all ALL USING (true) | RLS_DISABLED |
| profiles | on | — | RLS_NO_POLICIES |
| posts | on | public_read SELECT USING (true) | RLS_TAUTOLOGY |
| comments | on | select_own SELECT USING ((auth.uid() = user_id)) · insert_any INSERT USING (—) | MISSING_WITH_CHECK, RLS_UNWRAPPED_AUTH_CALL, UNINDEXED_RLS_PREDICATE |
| storage.objects | on | — | OK |
| buckets: avatars (public → PUBLIC_BUCKET_EXPOSURE) · receipts (private) | |||
Keep watching after launch
Find the hole. Track the drift. Fix it.
RowShield turns a one-time security check into a signal you can keep acting on.
Scheduled policy scans
RLS, storage, key exposure and policy-performance checks run on the cadence your plan needs.
Drift you can act on
See what appeared, came back after a fix, or disappeared instead of reading the same report every time.
Alerts on transitions
Slack, Discord, email or webhooks notify you when a finding changes state, not every time a scan runs.
Start with the failures that matter
Each finding comes with the SQL that fixes it, generated from your actual columns.
Any table reachable through PostgREST with RLS disabled is world-readable to anyone holding the anon key — which ships in your client bundle and is public by design. Every row is exposed.
RLS_DISABLEDA permissive policy whose expression is a constant true grants the whole table to every role it targets. RLS is enabled, so the dashboard reports the table as protected while it is wide open.
RLS_TAUTOLOGYThe service_role key bypasses RLS entirely. Once it is in a client bundle it is public, and every policy in the project is decorative. Rotate the key immediately and move the calls that need it behind a server route.
SERVICE_ROLE_KEY_EXPOSEDBuilt with Lovable, Bolt, Cursor or v0? Start here.
If an AI tool generated your schema, it almost certainly did not generate the row-level security policies to go with it. Paste your app's URL above and see what your anon key can read right now.
What the free check sees — and what it doesn't
Sees
- Tables readable with the public anon key
- A service_role key shipped to the browser
Does not see (until you connect)
- RLS disabled on a table
- Tables with no policies
- Always-true policies
- Missing WITH CHECK
- Unindexed RLS predicates
- Public storage buckets
- Unwrapped auth() calls
- Drift between scans
- Is it safe to expose my Supabase anon key?
- Yes, when every table has RLS enabled with correct policies — that is exactly what the free check reads back for you before you connect anything.
- What does "nothing stored" mean here?
- The probe keeps no URL, no result and no log line with your project in it; when the dialog closes, it is gone.
- Why only GET, HEAD and OPTIONS?
- Because reading is enough to show what the anon key can read; the probe never writes, and it refuses a service_role key before sending anything.
Continuous monitoring
Keep your security check running after launch
Start with the free audit, then choose a monthly monitoring plan when you want RowShield watching the catalog for you.
RowShield Indie
or $290/yr
For one developer shipping fast.
- Up to 3 projects
- Hourly scans
- Email and Slack alerts
- 1 seat
- Full findings and remediation SQL
RowShield Team
or $990/yr
For a team that has customers to answer to.
- Up to 15 projects
- 15-minute scans
- Email, Slack, Discord and custom webhooks
- Unlimited team seats
- Full findings and remediation SQL
RowShield Growth
customFor agencies and platforms monitoring many customer projects.
Get product updates
Leave your email for release notes and pricing updates — the free audit is available today.
Founding customers (first 100) lock in 25% off annual forever.
Check your public Supabase surface
Run the free read-only audit on a deployed app. No account, database writes or configuration are required.
