Supabase RLS Security Scanner

22% of Supabase projects I've scanned leak user data anonymously to anyone on the internet. This actor checks yours in 30 seconds. No service-role key. No SSH. No installs. Just URL + anon key, get back the exact curl an attacker would use, plus the SQL to plug each hole.

Probes a public Supabase project for Row-Level-Security misconfigurations. Detects tables readable by the anon key — the #1 cause of Supabase data leaks. Returns table-level row counts and a verbatim curl command to reproduce each finding.

💸 Found a leak? I do turnkey audits + RLS policies + key rotation for $99 (Stripe — 48h, money-back if nothing actionable). Or $29/mo weekly auto-scans at rls-monitor.vercel.app.

⭐️ Like this scanner? Solo dev competing with bigger Apify publishers. A 30-second review on my profile is the only thing that moves ranking. Thank you.

Why this exists

The Supabase anon key is meant to be public — it ships in your frontend. The only thing keeping your tables private is Row-Level Security policies. When RLS is forgotten on even one table, the data is publicly readable to anyone with your URL + anon key.

Across 100+ Supabase projects I've audited, 22% leak user data anonymously because RLS was forgotten on at least one table. This actor lets you check yours in 30 seconds.

What you actually get

1. A safe, count-only scan — uses Prefer: count=exact + Range: 0-0 so the scanner never pulls row data, just confirms exposure.
2. A copy-pasteable proof — the exact curl an attacker would run to dump your data.
3. A copy-pasteable fix — the SQL ALTER TABLE ... ENABLE ROW LEVEL SECURITY + a policy starter per leaky table.
4. A beautiful HTML report saved to your run's KV store, ready to share with your team.

Input

{
  "supabaseUrl": "https://your-project.supabase.co",
  "anonKey": "eyJ...your-anon-public-key...",
  "tableHints": ["optional", "extra", "tables", "to", "probe"],
  "outputFormat": "both"
}

• supabaseUrl — your project URL from Supabase Dashboard → Project Settings → API.
• anonKey — your anon/public key (NOT service_role). This is the same key you put in your frontend.
• tableHints — beyond ~40 common tables (users, profiles, orders, etc.) probed by default, list any schema-specific tables you'd like checked.
• outputFormat — json for programmatic use, html-report for human-readable HTML in KV store, both (default).

Output

{
  "projectRef": "abcdefgh",
  "url": "https://abcdefgh.supabase.co",
  "scannedAt": "2026-05-12T15:00:00Z",
  "tablesProbed": 47,
  "findings": [
    {
      "table": "profiles",
      "readable": true,
      "count": 1843,
      "severity": "critical",
      "columns": ["id", "email", "full_name", "..."],
      "sensitiveColumns": ["email"],
      "reproducer": "curl 'https://.../rest/v1/profiles?select=*' -H 'apikey: <anon-key>' -H 'Prefer: count=exact' -H 'Range: 0-0' -I"
    }
  ],
  "summary": {
    "total_anon_readable": 3,
    "critical_count": 2,
    "high_count": 1,
    "medium_count": 0,
    "total_exposed_records": 2074
  },
  "next_steps": ["Rotate the anon key...", "For each finding ALTER TABLE...", "Re-run this scan..."],
  "paid_fix_offer": {
    "price_usd": 99,
    "stripe_link": "https://buy.stripe.com/00w9AT9TWdaW7yx9KkcAo01"
  }
}

Plus a beautiful HTML report saved to the run's key-value store as report.html.

Ethical use

• Only scan projects you own or have explicit permission to scan.
• Counts only, never row data: the scanner uses Prefer: count=exact + Range: 0-0 to confirm a leak exists without exfiltrating contents.
• All findings remain private to the run owner unless explicitly shared.

Related tools

• CLI (free, runs entirely on your machine): npx @perufitlife/supabase-security --discover --url <URL> --key <KEY>
• Weekly auto-scan SaaS ($29/mo): rls-monitor.vercel.app
• Turnkey paid fix ($99 one-time): stripe
• Sister scanners: Firebase, PocketBase, Appwrite, Nhost (search @perufitlife on npm).

Built and maintained by Renzo Madueño, founder of Rotate Pilot, aviation exam-prep software. Open source: supabase-security-skill · GitHub.

If this actor saves you from a data leak, please leave a review. That's the engine that keeps this thing free + improving.