# Supabase Security Audit - Find RLS Leaks Free (`renzomacar/supabase-security-auditor`) Actor

Audit any Supabase project for missing RLS, public tables, dangerous SECURITY DEFINER functions, public storage buckets, and over-permissive policies. Active anon probe confirms live leaks. HTML report with paste-ready fix SQL. Read-only token, never -- By Renzo Madueno, https://rotatepilot.com

- **URL**: https://apify.com/renzomacar/supabase-security-auditor.md
- **Developed by:** [Renzo Madueno](https://apify.com/renzomacar) (community)
- **Categories:** Developer tools
- **Stats:** 2 total users, 1 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

Pay per usage

This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-usage

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Supabase Security Auditor

**If RLS is missing on even one table in your `public` schema, anyone with your anon key (sitting in your JS bundle) can read every row in that table right now.** This actor finds those leaks in 30 seconds and tells you exactly which tables to fix.

> I scanned my own production project last week and found **17 publicly readable tables I had no idea about** — `b2b_leads`, `engagement_emails`, internal growth metrics. Anyone with the anon key from the JS bundle could read or delete them.

**Free in-browser scanner** (no install, no token): https://perufitlife.github.io/supabase-security-skill/scan.html

> Scan any Supabase project for security misconfigurations. Get a shareable HTML report with copy-paste fix SQL on every finding.
> No install. No SaaS account. Your token is used only for the run and never stored.

### Why this exists

On **May 30, 2026** Supabase changed its default for new projects: tables in `public` no longer auto-expose to the Data API. On **October 30, 2026** that becomes the enforced default for **all existing projects**.

If you've been on Supabase for more than a few months, you almost certainly have:

- Tables granted CRUD to `anon` by default (because that was the default).
- One or two tables where RLS got missed.
- `SECURITY DEFINER` functions that are technically callable by `anon`.

This actor surfaces all of that in one click. I built it after running it on my own production app and finding **17 publicly readable tables I had no idea about** — `b2b_leads`, `engagement_emails`, internal growth metrics. Anyone with the anon key from the JS bundle could read or delete them.

### What it checks

| # | Check | Severity |
|---|---|---|
| 1 | Table has RLS disabled and direct anon grants | **CRITICAL** |
| 2 | Table in `supabase_realtime` publication WITHOUT RLS (leak via WebSocket) | **CRITICAL** |
| 3 | `SECURITY DEFINER` function (non-trigger) executable by `anon` | HIGH |
| 4 | Anonymous sign-ins enabled | HIGH |
| 5 | Public storage bucket | HIGH |
| 6 | Default privileges still grant CRUD on future tables | MEDIUM |
| 7 | Auth signups enabled without email confirmation | MEDIUM |
| 8 | Weak password policy (`password_min_length < 8`) | MEDIUM |
| 9 | No CAPTCHA on auth endpoints | MEDIUM |
| 10 | `SECURITY DEFINER` function without `SET search_path` | MEDIUM |
| 11 | RLS-locked table still has direct anon grants (defense-in-depth) | LOW |

### Output

- **HTML report** — self-contained (~25KB Tailwind + Chart.js via CDN). Saved to the run's key-value store under key `REPORT`. URL: `https://api.apify.com/v2/key-value-stores/{storeId}/records/REPORT`. Open in any browser. Includes copy-paste fix SQL on every finding plus an "apply all" SQL bundle.
- **Dataset** — every finding as a structured row (severity, title, target, fix_sql) for filtering/exporting in the Apify console.
- **SUMMARY KV record** — quick numbers for monitoring (counts by severity, total tables/functions/buckets scanned).

### Sample report

The HTML report header shows your project name, region, scan timestamp, a letter grade (A+ → F), and KPI tiles for each severity level. Below that: severity bar chart, every finding as an expandable card, and a single "apply all" SQL bundle at the bottom.

### How to get a Personal Access Token

1. Open https://supabase.com/dashboard/account/tokens
2. Click "Generate new token"
3. Read access is enough for the audit (the actor never writes to your project)

The token is passed as input, used only for this run's Management API queries, and never persisted by the actor.

### Apply the fixes

The actor never modifies your project. To apply fixes:

1. Open the HTML report
2. Review each finding (some `SECURITY DEFINER` functions are intentionally exposed to anon — your decision)
3. Click "Copy all SQL" at the bottom
4. Paste into Supabase Dashboard → SQL Editor
5. Run inside `BEGIN; ... ROLLBACK;` first to verify, then `BEGIN; ... COMMIT;`

For a full agent loop (audit + preview + apply + re-audit) inside Claude Code / Cursor / Cline, see the sibling MCP server: https://github.com/Perufitlife/supabase-security-mcp

### Want a written report + Q\&A support?

Free actor → you find leaks. **$29 lite tier** (top 5 critical fixes + written summary) or **$99 full audit** (every table/policy/bucket + 30-day Q\&A + paste-ready SQL bundle, 24h delivery). The CTA links inside the HTML report take you to Stripe.

### Pricing

Pay per run. The audit completes in 10–60 seconds depending on project size.

### Source

Open source MIT — https://github.com/Perufitlife/supabase-security-skill

### Limits

- Doesn't audit per-object Storage RLS yet (would mean iterating every file)
- Cannot revoke `supabase_admin` default privileges via SQL — that needs the Dashboard toggle. The report tells you so.
- App APIs intentionally exposed to anon (e.g. `get_public_stats()` RPC) appear as findings. You decide which are intentional.
- Alpha. PRs and issues welcome on GitHub.

# Actor input Schema

## `projectRef` (type: `string`):

Your Supabase project reference (the 20-char string in your project URL, e.g. abcdefghijklmnopqrst from https://abcdefghijklmnopqrst.supabase.co).

## `accessToken` (type: `string`):

Supabase Personal Access Token. Create one at https://supabase.com/dashboard/account/tokens (read access is enough for the audit). Token is used only for this run and never stored.

## `outputFormat` (type: `string`):

Choose 'html-report' for a self-contained shareable HTML dashboard with copy-paste fix SQL (saved to KV store as REPORT). 'json' returns raw findings only. 'both' produces both.

## Actor input object example

```json
{
  "outputFormat": "html-report"
}
```

# Actor output Schema

## `results` (type: `string`):

All result items as JSON.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {};

// Run the Actor and wait for it to finish
const run = await client.actor("renzomacar/supabase-security-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {}

# Run the Actor and wait for it to finish
run = client.actor("renzomacar/supabase-security-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{}' |
apify call renzomacar/supabase-security-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,renzomacar/supabase-security-auditor"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/eDGQo6z0qH5zdKWnx/builds/heV9zoROfLlsizOBa/openapi.json