Supabase security
Supabase RLS audit: every table, policy and key checked.
A Supabase security audit checks that no one can read or change data they shouldn't. PixelRidge Web checks row level security on every exposed table, the policies on each one, storage buckets, database functions and views, and where your keys are used, then fixes what's wrong and shows you how to test it yourself.
What we fix
What the audit checks.
Row level security turned off
Supabase's public (anon or publishable) key is meant to be in the browser. With RLS off on a table in an exposed schema, that key can read the whole table.
Policies that allow everyone
A policy that simply says “true” for signed-in users lets any signed-in person read every row, not just their own.
Views and functions that skip RLS
Views run with their owner's rights unless set to security invoker, and security definer functions do too. Either can quietly bypass the rules on the tables.
Storage buckets
Public buckets, or bucket policies that don't check the owner, can expose uploaded files such as IDs and invoices.
The service role key in the wrong place
The service role or secret key bypasses every rule. It must never reach the browser or a mobile app.
How it works
Three fixed prices.
Check
US$29
3 days
We read your whole code and database and tell you what is wrong.
Fix and secure
US$79
7 days
Everything in Check, then we fix it.
Fix, secure and launch
US$129
14 days
Everything above, plus a working launch.
Prices in US dollars. You pay half to start and the rest only after you have tested the work. Bigger jobs are quoted in writing after the Check. See what each price includes.
Terms and conditions apply. Read the terms.
You own everything
The Supabase project should sit in an organisation you own, with at least two people who can sign in, backups turned on and the keys rotated if they were ever exposed.
No findings, no fee
If our audit of your app or site finds nothing worth fixing, you don't pay for the audit.
Smaller one-off fixes start at $20 each in our price calculator. Moving off a builder's hosting is covered by Rescue & Migration, and keeping the app healthy afterwards by Launch Care.
Questions
Common questions about Supabase
How do I know if my Supabase database is leaking data?
Check that RLS is enabled on every table in schemas the API exposes, then test with the public key as a signed-out visitor and as a second user. The Supabase dashboard's Security Advisor also flags tables without RLS. Our free scan checks the signed-out case on a live app you own.
Is the Supabase anon key safe to expose?
Yes, it is designed to be public, but only if row level security protects every table. The service role or secret key is different: it bypasses all rules and must stay on the server.
What does the audit include?
Every table, policy, view, function and storage bucket reachable through the API, plus where each key is used in your code. You get a written report and a fixed price to fix what we find.
What if the audit finds nothing?
No findings, no fee. If our audit of your app or site finds nothing worth fixing, you don't pay for the audit. The first Launch Check is always free.
Is there a free way to check my app first?
Yes. The free PixelRidge security scan checks a live app you own for exposed keys, database tables readable without logging in, missing security headers and privacy basics. It is passive and read-only. For a human review, send your link for a free Launch Check and we record a short video of the top risks we see. Before launch, the free Launch Readiness Checklist scores your app on domain, security, data, legal and payments.
Want a quick first check? Score your app with the free launch checklist or see all free tools.
Guides
"new row violates row-level security policy" in Supabase: the real fixes (without turning RLS off)
Supabase publishable key vs anon key: are they the same, and how to switch (2026)
Stripe webhook failing in a Supabase Edge Function? Fixing "SubtleCryptoProvider cannot be used in a synchronous context"
Is Supabase banned in India? 2026 status and workaround
Lovable Cloud to Supabase: what does not transfer when you migrate
Is Lovable secure? What its security scan catches, and what it misses (2026)
Send us your Supabase app's link.
We record a short video showing the top risks we see, free and with no obligation, then quote a fixed price.
Terms and conditions apply. Read the terms.