Skip to content
RLS isolation review

Prove your row-level security actually isolates tenants.

Most Supabase data leaks are not exotic. They are a table with RLS switched off, a policy keyed on a claim the user can edit, or a view that quietly serves rows past the policy. We audit that configuration and prove tenant isolation at the database, then commit the test that keeps it proven.

The free engine

rls-audit

An open-source command-line auditor for Postgres and Supabase row-level security. It connects to the database URL you give it and prints to your terminal. No account, no upload, no telemetry. Apache-2.0.

npx rls-audit detect --db "$SUPABASE_DB_URL"

detect

A read-only scan of the catalogues. It flags RLS left off on an API-exposed table, a policy trusting client-editable metadata, a view that bypasses its own policies, and six more configuration faults, in seconds.

probe

One live table, read-only. It signs in as tenant A and checks that tenant B’s rows are invisible. It seeds a positive control first, so it can never report green on a check that proved nothing.

isolate

A seeded suite across every table you declare: read, update, delete, and a smuggled insert, run as one tenant against another. Every write it makes is inside a transaction that is always rolled back.

A clean scan is necessary but not sufficient. The catalogue cannot prove a policy’s logic is right, only that the guard rails are there. The isolation probes prove the logic.

The paid review

Authorized RLS and Auth Isolation Configuration Review

A fixed-scope review with a 48-hour turnaround, once you have signed the authorisation and provisioned a staging or branch database clone. It is a configuration review and isolation test. It is not a penetration test.

A written report

Every finding by severity, in plain language, with the exact fix. Scoped to the schemas we agree, at a point in time.

A test suite in your repo

A reproducible FORCE-RLS isolation suite committed to your repository, so the proof lives with your code and re-runs on demand.

A remediation pull request

On the remediation tier, we fix the findings, prove the suite goes green, and open the pull request for your team to review and merge.

All writes are confined to the disposable clone you provision and are rolled back. Nothing is persisted, and we never touch your production database. Our total liability is capped at the fees you pay.

Pricing

Fixed scope, fixed fee.

Configuration review

start here

A$700

per review

The scan, the isolation proof, the written report, and the test suite committed to your repo. Founding rate of A$350 to A$450 for the first three clients, in exchange for a testimonial.

Review and remediation

A$1,500 to A$2,500

per engagement

Everything in the review, plus we write the fixes, prove the suite goes green, open the remediation pull request, and re-test.

CI-regression retainer

A$149

per month

The isolation suite re-runs on every migration and pull request, so a later change cannot silently reopen a hole. A monthly summary, and a fast path back to us if a regression appears.

All prices in Australian dollars, excluding GST. Invoiced through Xero and paid by bank transfer.

What we check

The faults that leak Supabase data.

  • Critical

    RLS disabled on a table granted to the anon or authenticated API roles.

  • Critical

    A policy that authorises on user_metadata, which the end user can edit.

  • Warning

    RLS enabled but not FORCEd, so the owner and definer functions bypass it.

  • Warning

    RLS enabled with no policies at all, a deny-all that is usually unfinished.

  • Warning

    A policy that matches every row, or accepts any written row.

  • Warning

    A SECURITY DEFINER function with no pinned search_path.

  • Warning

    A view without security_invoker sitting over an RLS-governed table.

  • Info

    auth.uid() not wrapped as (select auth.uid()), a table-scan cost.

Scope and honesty

What a clean result does and does not mean.

  • We check the row-level security and auth-isolation configuration of the schemas we agree, and we prove tenant isolation at the database layer. That is the whole of it.
  • We do not test your application code, your API gateway, or anything above the database. We are not a penetration test and do not claim to be.
  • A clean result is evidence about the tables and policies we saw, at the time we saw them. It is not a guarantee that your application is secure.
  • A signed authorisation comes before any access. You can withdraw it in writing at any time.

Get the tool and the occasional note

The command line auditor is free and needs no sign-up. Leave an email if you want the release notes and the technical write-ups as they land.

Bring us the database. We’ll bring the proof.

A signed authorisation, a staging clone, and 48 hours. You get the report and the test that keeps it true.