Test your Row Level Security policies in 30 seconds. Enter your project URL and anon key — we probe your tables and show you what's exposed to unauthenticated requests.
anon key — NOT the service role key. This is the key already in your client-side code.Three steps. Thirty seconds. No account required.
We send GET requests to your Supabase REST API using only your anon key — exactly what an unauthenticated attacker would do.
We test for exposed tables, permissive SELECT policies, missing write policies, and common RLS misconfigurations.
Each check returns a pass, warning, or fail — with the exact policy pattern causing the gap and how to fix it.
Want a full security audit beyond RLS? The free scan covers all 4 dimensions →