Free Supabase RLS checker

Supabase RLS checker: see what’s public.

Paste your application URL to see which observable tables an unsigned visitor can read. No account, DNS verification or writes.

Check your application

One public URL is enough.

No signup. No DNS. No writes. Only test an application you own or are authorized to assess.

A focused check with visible limits

No magic score. The report only states what the external check actually observed.

Anonymous reads

The checker looks at what an unsigned visitor can receive through the Supabase Data API.

Uncertainty stays visible

An empty response is inconclusive. It is never turned into a false green light.

No writes

The check creates no account, inserts no data and requires no DNS verification.

When to run RLS Checker

01

Before a beta

Before inviting the first users.

02

After a migration

After changing a table, grant or policy.

03

Before production

Just before deploying a new version.

What can someone read without signing in?

Your application can look private while its data API allows anonymous reads. RLS Checker follows the public application path, discovers observable Supabase tables and checks the response available to a visitor without a login.

The check needs only your application URL. It does not request an administrator key or account password. It tests bounded reads, makes no writes, and leaves your database unchanged. A public key in a frontend is expected; access to private data is what needs investigation.

An example report, explained

Illustrative table names and outcomes. These are synthetic examples, not a scan of your application.

ExampleObservationNext step
Private ordersReadable, potentially sensitiveCheck intended access, repair permissions and retest.
Published catalogueReadable, likely publicConfirm that these rows are meant to be public.
Private profilesAnonymous read rejectedAlso test account isolation and write permissions.
Empty tableNo row returned, inconclusiveTest with known data and the intended user role.

A blocked or empty response is not a certificate for your database. The report only covers the tables and requests observed in that run. Authenticated accounts, Storage and write policies require separate tests.

Read the methodology and reproduce the local examples

Understand the result. Check the next step.

How to test Supabase RLS

Combine an external check with known test records, two accounts and operation-specific database tests.

Read the guide

Is your exposed anon key a secret?

Distinguish public project configuration from privileged credentials, and check what the public API actually permits.

Read the guide

Why an empty response is inconclusive

Reproduce how an RLS-filtered table and an unprotected empty table produce the same zero-row result.

Read the guide
All Supabase RLS guides

Questions about testing Supabase RLS