SUPABASE RLS CHECKER

Find Supabase access rules that deserve a closer look.

Pallos looks for Supabase migrations, policies, client setup, and route code that can reveal overly broad database access or a dangerous trust boundary.

Scan a public repository See how scoring works
Read-onlyNo account requiredSecret values stay hidden
WHAT IT LOOKS FOR

Focused signals with file-level evidence.

  • Permissive RLS policy expressions that may allow every row
  • Service-role or privileged credentials placed in client code
  • Database access that relies only on the browser to enforce permissions
  • Missing evidence for policy coverage, kept visible as untested instead of passed
WHAT IT CANNOT PROVE

Unknown stays unknown.

  • Static source cannot confirm the policies currently deployed in your Supabase project.
  • Pallos does not log into your database during a public scan.
  • Complex SQL and application-specific authorization still require human review and runtime tests.
HOW THE FREE SCAN WORKS

Paste. Review. Fix.

  1. 01

    Paste a public GitHub URL

    Use code you own or are authorized to review.

  2. 02

    Read the evidence

    See the affected file, risk, explanation, and practical fix direction.

  3. 03

    Make the change yourself

    Pallos never pushes or edits your repository.

COMMON QUESTIONS

What this check means.

Does this connect to my Supabase database?

No. The free public scan reviews repository source only and does not require database credentials.

Can it prove RLS is enabled on every table?

Only when the repository contains enough migration or policy evidence. Anything it cannot prove remains explicitly untested.

What stacks are supported?

The current scanner is strongest on JavaScript, TypeScript, Next.js, Supabase configuration, SQL migrations, and common API route patterns.

FREE · PUBLIC REPOSITORIES

Check the code before users find the mistake.

No payment, account, or installation. The repository stays unchanged.

Start the scan