Prove your row-level security actually isolates tenants.
Most Supabase data leaks are not exotic. They are a table with RLS switched off, a policy keyed on a claim the user can edit, or a view that quietly serves rows past the policy. We audit that configuration and prove tenant isolation at the database, then commit the test that keeps it proven.
rls-audit
An open-source command-line auditor for Postgres and Supabase row-level security. It connects to the database URL you give it and prints to your terminal. No account, no upload, no telemetry. Apache-2.0.
npx rls-audit detect --db "$SUPABASE_DB_URL"detect
A read-only scan of the catalogues. It flags RLS left off on an API-exposed table, a policy trusting client-editable metadata, a view that bypasses its own policies, and six more configuration faults, in seconds.
probe
One live table, read-only. It signs in as tenant A and checks that tenant B’s rows are invisible. It seeds a positive control first, so it can never report green on a check that proved nothing.
isolate
A seeded suite across every table you declare: read, update, delete, and a smuggled insert, run as one tenant against another. Every write it makes is inside a transaction that is always rolled back.
A clean scan is necessary but not sufficient. The catalogue cannot prove a policy’s logic is right, only that the guard rails are there. The isolation probes prove the logic.
Authorized RLS and Auth Isolation Configuration Review
A fixed-scope review with a 48-hour turnaround, once you have signed the authorisation and provisioned a staging or branch database clone. It is a configuration review and isolation test. It is not a penetration test.
A written report
Every finding by severity, in plain language, with the exact fix. Scoped to the schemas we agree, at a point in time.
A test suite in your repo
A reproducible FORCE-RLS isolation suite committed to your repository, so the proof lives with your code and re-runs on demand.
A remediation pull request
On the remediation tier, we fix the findings, prove the suite goes green, and open the pull request for your team to review and merge.
All writes are confined to the disposable clone you provision and are rolled back. Nothing is persisted, and we never touch your production database. Our total liability is capped at the fees you pay.
Fixed scope, fixed fee.
Configuration review
start hereA$700
per review
The scan, the isolation proof, the written report, and the test suite committed to your repo. Founding rate of A$350 to A$450 for the first three clients, in exchange for a testimonial.
Review and remediation
A$1,500 to A$2,500
per engagement
Everything in the review, plus we write the fixes, prove the suite goes green, open the remediation pull request, and re-test.
CI-regression retainer
A$149
per month
The isolation suite re-runs on every migration and pull request, so a later change cannot silently reopen a hole. A monthly summary, and a fast path back to us if a regression appears.
All prices in Australian dollars, excluding GST. Invoiced through Xero and paid by bank transfer.
The faults that leak Supabase data.
- Critical
RLS disabled on a table granted to the anon or authenticated API roles.
- Critical
A policy that authorises on user_metadata, which the end user can edit.
- Warning
RLS enabled but not FORCEd, so the owner and definer functions bypass it.
- Warning
RLS enabled with no policies at all, a deny-all that is usually unfinished.
- Warning
A policy that matches every row, or accepts any written row.
- Warning
A SECURITY DEFINER function with no pinned search_path.
- Warning
A view without security_invoker sitting over an RLS-governed table.
- Info
auth.uid() not wrapped as (select auth.uid()), a table-scan cost.
What a clean result does and does not mean.
- We check the row-level security and auth-isolation configuration of the schemas we agree, and we prove tenant isolation at the database layer. That is the whole of it.
- We do not test your application code, your API gateway, or anything above the database. We are not a penetration test and do not claim to be.
- A clean result is evidence about the tables and policies we saw, at the time we saw them. It is not a guarantee that your application is secure.
- A signed authorisation comes before any access. You can withdraw it in writing at any time.
Get the tool and the occasional note
The command line auditor is free and needs no sign-up. Leave an email if you want the release notes and the technical write-ups as they land.
Bring us the database. We’ll bring the proof.
A signed authorisation, a staging clone, and 48 hours. You get the report and the test that keeps it true.