Does it connect to my database?

No, it reads your migration files. For a live project, check-live.sql runs two read-only queries in the SQL editor.

How is it different from the Supabase Security Advisor?

The advisor checks the live database after deploy; this checks migrations before deploy (and in CI), adds checks like inserts not tied to the user, and writes the fix migration.

Does it work without the Supabase CLI?

Yes, point it at any folder of Postgres .sql files.

How do I get the files?

Pay by card right here on youraitools.co: your download links appear on this page the moment the payment goes through (claim window: 72 hours, up to 5 downloads per 7 days). Need the files re-sent later? Email hello@youraitools.co.

Email hello@youraitools.co within 14 days if it doesn’t work and we can’t fix it.

Can I pay with crypto?

Yes. Pay the same price in USDC or USDT on Base, Ethereum, Arbitrum, Optimism, Polygon or Solana from the "Pay with crypto" button, with no account or KYC. We check the payment on-chain and show your download links as soon as it confirms.

Supabase RLS Checker

Name: Supabase RLS Checker
Brand: YourAITools
Price: 19.00 USD
Availability: InStock

See which tables anyone with your public anon key can read or change, and get the migration that fixes them.

$19 one-time

Buy and download

Pay with crypto (USDC or USDT)

Same price on Base, Ethereum, Arbitrum, Optimism, Polygon or Solana. No account, no KYC. Files appear as soon as the payment confirms. How it works

14-day refund: if it doesn’t work and we can’t fix it, email hello@youraitools.co within 14 days and we refund you.

Sold by YourAITools. Support: hello@youraitools.co

Delivery: Pay by card right here on youraitools.co. Your download links appear right on this page the moment payment goes through (claim window: 72 hours, up to 5 downloads per 7 days). Need the files re-sent later? Email hello@youraitools.co.
Format and license: Zip, 17 KB, v1.0, 16 files. You may use and modify this kit for your own work and for clients you serve, including paid client work. Not affiliated with or endorsed by Supabase.
Refunds: 14-day refund: if it doesn’t work and we can’t fix it, email hello@youraitools.co within 14 days and we refund you. Refund policy

Supabase RLS Checker product illustration

What it does

Row Level Security is the only thing standing between your Supabase anon key (which is public, in your JavaScript) and your data. This checker reads your migration files and tells you, before you deploy, which tables anyone can read or change, which policies are secretly true for everyone, and which ones will make your queries slow, with the SQL to fix each one.

Reads supabase/migrations/*.sql in order (create, alter, rename, drop, policies, views, functions, grants) and checks the final schema.
14 rules, named after Supabase's own database linter where one exists (0013 rls_disabled_in_public, 0024 rls_policy_always_true, 0015 user_metadata, 0003 auth_rls_initplan, 0010 security definer views, 0011 search_path, 0028 anon-callable definer functions...), plus checks the linter can't make from a live database: inserts not tied to the signed-in user, "any signed-in user" update policies, grants to anon on tables without RLS.
--fix-sql fixes.sql writes a starting migration: enable RLS plus owner policies, security_invoker views, revoked function grants. Review it before running.
Works offline in CI and pre-commit: no database, no keys, Python 3.9+ standard library only. Exit 1 on errors.
check-live.sql: two read-only queries to paste into the Supabase SQL editor for a project that's already deployed.
Claude Code skill (skills/supabase-rls): Claude runs the check and writes the fix migration with the right policy patterns.

What you get

The screenshot is real output from the kit’s own commands. Tested from a fresh download of this exact zip: ./run_tests.sh ran 11 tests OK on Python 3.13 and 3.10.

Real terminal output from Supabase RLS Checker: demo and passing tests

Use

python3 -m rlscheck                        # the project in the current folder
python3 -m rlscheck path/to/app --fix-sql supabase/migrations/20261110000000_fix_rls.sql
python3 -m rlscheck . --format md > RLS-REPORT.md
python3 -m rlscheck . --schema api         # also check another exposed schema

./demo.sh runs it on a fictional notes app (5 errors, 6 warnings) and the fixed version (clean). ./run_tests.sh runs 11 tests.

Rules

Rule	Level	Finds
RLS001	error	table in public without RLS (0013)
RLS003	error	policies exist but RLS is off (0007)
RLS004	error / note	using (true) / with check (true) on update, delete, insert or all (0024); public read noted
RLS006	error	policies that read user_metadata (0015)
RLS009	error	grant ... to anon/authenticated on a table without RLS
RLS012	error	everyone can read a table with sensitive column names (email, phone, token, card_number...) (0023)
RLS005	warning	auth.uid() / auth.jwt() not wrapped in (select ...) (0003)
RLS008	warning	insert policy that doesn't check the owner column
RLS010	warning	views without security_invoker = true (0010)
RLS011	warning	security definer functions without set search_path (0011)
RLS013	warning	security definer functions in public callable by anon (0028)
RLS014	warning	update/delete allowed for any signed-in user
RLS002	note	RLS on but no policies (0008)
RLS007	note	several permissive policies for the same role and action (0006)

Honest limits

It reads SQL text. Changes made in the dashboard, or by migrations that build SQL dynamically, aren't seen; run check-live.sql or the Security Advisor on the live project too.
It can't know your business rules: a policy can be valid SQL and still let the wrong people in. Test as a second user.
Not affiliated with Supabase.

Related: Vibe Coding Security Audit (keys, routes, webhooks): https://youraitools.co/marketplace/vibe-coding-security-audit. Cursor Rules for Supabase: https://youraitools.co/marketplace/cursor-rules-supabase

Format and license

Zip, 17 KB, v1.0, 16 files. You may use and modify this kit for your own work and for clients you serve, including paid client work. Not affiliated with or endorsed by Supabase.

FAQ

Does it connect to my database?: No, it reads your migration files. For a live project, check-live.sql runs two read-only queries in the SQL editor.
How is it different from the Supabase Security Advisor?: The advisor checks the live database after deploy; this checks migrations before deploy (and in CI), adds checks like inserts not tied to the user, and writes the fix migration.
Does it work without the Supabase CLI?: Yes, point it at any folder of Postgres .sql files.
How do I get the files?: Pay by card right here on youraitools.co: your download links appear on this page the moment the payment goes through (claim window: 72 hours, up to 5 downloads per 7 days). Need the files re-sent later? Email hello@youraitools.co.
Refunds?: Email hello@youraitools.co within 14 days if it doesn’t work and we can’t fix it.
Can I pay with crypto?: Yes. Pay the same price in USDC or USDT on Base, Ethereum, Arbitrum, Optimism, Polygon or Solana from the "Pay with crypto" button, with no account or KYC. We check the payment on-chain and show your download links as soon as it confirms.

Get Supabase RLS Checker

Supabase RLS checker for migrations: tables without RLS, using (true) policies, user_metadata, slow auth.uid(), definer views. Fix SQL included. $19.

$19 one-time

Buy and download Pay with crypto

Save with a bundle

Ship-Safe Security Bundle: 3 products for $45 ($67 separately, you save $22).

Pairs well with

Download$19

Dockerfile Linter & Best Practices Checker

Dockerfile linter with fixes: non-root user, pinned slim images, secrets in ENV/ARG, apt cache, COPY order, .dockerignore. SARIF + Claude Code skill. $19.

View Dockerfile Linter & Best Practices Checker

DownloadFree

GitHub Actions Security Checker (Free)

Free GitHub Actions security checker: script injection, pull_request_target, unpinned actions, token permissions and secrets, with fixes. Offline, SARIF.

View GitHub Actions Security Checker (Free)

DownloadFree

Free Schema Markup Validator

Free schema markup validator: check JSON-LD against Google's rich result rules, spot retired FAQ and HowTo markup, bad prices and dates. Files, folders or URLs.

View Free Schema Markup Validator

1 email a week: new x402 + MCP tools and free kits.

Short weekly digest of new x402 + MCP tools and free kits, including the MCP OAuth Checker. No spam, unsubscribe any time.