Skip to content
StackSiren
Free scan

Supabase RLS checker

Apps built with Lovable, Bolt and v0 talk to Supabase straight from the browser using the anon key. This checker finds the project and key your site ships, and tests what that key can see without reading any of your data.

Passive, read-only check. No signup, no email needed.

What this checks

  • Which Supabase project your site uses, and whether the key is anon/publishable or a leaked service_role/secret key
  • Whether the anon key can list your tables through the PostgREST API (schema exposure)
  • Whether public Storage buckets can be listed
  • Auth settings that let anyone sign up without confirming their email

How it works (and what it never does)

  • We read your page and same-origin JavaScript to find the Supabase URL and key, as any visitor could.
  • We call read-only Supabase endpoints (API root, storage bucket list, auth settings) with that public key.
  • We never read rows from your tables here. Row-level tests only run in a Deep Scan after you verify you own the site.

Fix guides

FAQ

Why doesn't this read my table rows?

Anyone can type any URL into a free tool, so reading rows here could expose someone else's data. Row-read tests run only in the Deep Scan, after you prove you own the site. You can also run the curl test in our RLS guide yourself.

My tables are listed. Is my data exposed?

Not necessarily. Listing means the anon role can see table names. Whether rows are readable depends on RLS policies. Enable RLS on every table and add policies, then re-check.

What changes on 30 October 2026?

Supabase stops automatically granting the anon and authenticated roles access to new tables in the public schema. New tables need explicit grants, which is safer but can break apps that relied on the old default.

Is the service_role key ever safe in the browser?

No. It bypasses RLS completely. If this tool finds one, rotate it in the Supabase dashboard immediately and move that code to a server or edge function.

More free tools