Protect data and access
Supabase RLS Policy Checker
This local Supabase RLS checker reviews pasted SQL for a focused set of risky row-level security patterns before you apply a migration.
Local analyzer: Runs entirely in this browser. SQL stays in your browser.
Synthetic example. Review policy behavior with two accounts before using it in an app.
Sample result
An example of the output shape, not a result from your input:
2 policies allow an anonymous read on a tenant table
Run this on your whole app
This check covered only what you pasted or selected here. A free trial lets you authorize a repository, live URL or API, run the checks available for your authorized target and plan and keep one launch report you can share.
Start free trialRelated tools
Most reviewers run two or three of these together. Each runs in your browser and states what it cannot prove.
See all free toolsWhat this checks
- ENABLE and FORCE ROW LEVEL SECURITY statements
- Always-true policies, SECURITY DEFINER and service-role references
- Obvious user, ownership, workspace, organization or tenant predicates
What this cannot prove
- It does not connect to Supabase or inspect your schema, grants, roles, views or deployed policies
- Static pattern matching cannot evaluate full SQL semantics or application authorization
- You still need positive and negative tests with at least two real accounts
Primary references
Use these standards and vendor references when you investigate a result. A link does not imply certification or full coverage of the source.
Frequently asked questions
Does this upload my input?
SQL stays in your browser.
Does a clear result mean my app is secure?
No. Each result is limited to the checks shown here. Use it as a next-step guide, then test the relevant application path.