Buyer's guide · Supabase security · Checked
Best Supabase security checker: free and paid options compared
For most Supabase projects the best first security checker is the free Security Advisor built into the Supabase dashboard (also available as supabase db advisors), which flags tables with Row Level Security off, always-true policies, views that bypass RLS and SECURITY DEFINER functions anyone can call. Add a free migration linter such as rls-lint or supabase-security if AI writes your migrations. Pay only for what the Advisor can't do: testing what a logged-out visitor or a second user can actually read and write, ongoing alerts, or someone writing the fixed policies for you.
Disclosure: ChikuOS sells some of the options below, and they're labelled "ChikuOS". No vendor paid to be listed or placed, and we earn no commission or affiliate fee from any link on this page. Prices and features of other products are as listed on their own sites on 18 October 2026; follow the links to check current terms.
Supabase security checkers compared (prices as listed by each vendor)
How we chose and ordered these: Free tools you run yourself come first, then hosted scanners (lowest one-off price first), then monitoring subscriptions (free tier first), then human review. We list what each vendor says its tool checks; we haven't run every tool against the same test project. How we compare.
| Option | Type | Price | What it checks | Good fit when |
|---|---|---|---|---|
| Supabase Security Advisor | Built-in lints on your live project | Free | RLS disabled on public tables, RLS on with no policy, always-true policies, security-definer views, policies using user_metadata, SECURITY DEFINER functions callable by anon | Always. Run it first and fix every error |
| splinter | Open-source SQL lints behind the Advisor | Free | The same lints, as one SQL file you run yourself | You want the Advisor's checks in your own scripts or CI |
| rls-lint | Open-source CLI on migration files (MIT) | Free | RLS gaps in migration SQL before you deploy. File-based, so it can't see changes made in the dashboard | AI tools write your migrations and you want a pre-deploy check |
| supabase-security | Open-source CLI (MIT, early v0.5) | Free | Lints migrations with no credentials; with an access token, audits the live project and probes with your public key | You want a free live check you run yourself |
| Locksoup | Hosted audit through a read-only Postgres role you create (open-source engine) | Free plan; Pro price not published | RLS, policies, functions, grants and storage buckets from your schema; fix SQL for you to review and run | You want a free schema-level audit without sharing your data |
| SupaSecure | Hosted scanner from your URL or public key | Free (1 scan a day, counts only); Pro $19 one-time | Exposed tables reachable with the credentials in your front end | A quick outside-in look without giving database access |
| RLS Guard | Paste the result of one read-only catalog query | Free scan; $29 one-time for details and fix SQL | One issue class: RLS off, RLS with no policy, policies open to anon/authenticated | You only want RLS policy gaps, with fix SQL |
| AuditYourApp | Hosted scanner, plus a human review tier | $49 a scan; $29/month for 2 scans; $499 expert review | RLS gaps, unprotected RPCs, leaked keys, storage, mobile app bundles | You also ship a mobile app, or want repeat scans |
| RowShield | Continuous RLS monitoring (needs a catalog-read connection string) | Free tier (daily scans); Indie $29/month (3 projects, hourly); Team $99/month (15 projects) | RLS off, no policies, always-true policies, missing WITH CHECK, public buckets | A team shipping schema changes every week |
| SafeWeave | Daily monitoring of Supabase's own advisor findings | $29 or $59/month (14-day trial) | Advisor findings per project, with email alerts on new critical issues | You want alerts, not a one-off report |
| ChikuOS Supabase Data-Leak Check | Human review of your own app | $99, 2–3 business days; $249 with fixes | Every table's RLS policies (exported or read-only access), what a logged-out visitor can read or write, storage and RPCs, keys in your bundles; severity-ranked PDF with the SQL | Real users or personal data, and you want a person to read each policy and hand you the fix |
Which one should you pick?
- Side project, no real users yet: the free Security Advisor. Fix every error-level finding, especially "Table publicly accessible". You probably don't need to pay anyone.
- AI writes your migrations and you deploy often: add rls-lint or supabase-security to your workflow (free), or add monitoring if you want alerts: RowShield has a free daily tier, and SafeWeave and RowShield's paid plans alert you sooner.
- You want an outside look without sharing database access: SupaSecure, AuditYourApp or one of the free vibe-coded app scanners.
- Real users, payments or personal data: a human review that reads each policy and tests as a logged-out visitor and as a second user. That's our $99 Supabase Data-Leak Check, or AuditYourApp's $499 expert review if you also want edge-function and business-logic review.
When a free tool is the better choice
If the Security Advisor shows no errors, every table has RLS on, and your policies are simple ownership checks like auth.uid() = user_id, a paid check is unlikely to find much. Spend the money later, when you add payments, teams or shared data. Cheaper automated tools (SupaSecure at $19, RLS Guard at $29) are also a better fit than our $99 review if you just want RLS gaps flagged and are happy to write the SQL yourself.
What no checker proves on its own
- Intent. Lints see your schema, not your rules. Supabase's own docs note some findings may be intentional, such as a public product catalogue.
- Reads vs writes. A table can be locked for reading but open for writing.
USINGandWITH CHECKare separate, so test both. - Functions. SECURITY DEFINER functions run as their owner and skip RLS. The Advisor flags ones anon or signed-in users can call; whether each is safe needs a person.
- The public key is meant to be public. Supabase's publishable (formerly anon) key is safe in your front end; RLS is what protects data. The secret (service_role) key bypasses RLS and must never ship to the browser (Supabase API keys docs).
Found something? Our step-by-step fixes for RLS disabled in public and security definer views start with a read-only check, and the SQL was tested before publishing. To see signed-out exposure yourself, try our free Supabase exposure checker.
FAQ
What is the best free Supabase security checker?
Supabase's own Security Advisor. It's free, built into the dashboard, and also runs from the CLI (supabase db advisors), the MCP get_advisors tool and the Management API. It flags tables with RLS off, policies that let everyone through, views that bypass RLS and risky SECURITY DEFINER functions.
Is the Supabase Security Advisor enough?
For a project without real users, often yes, as long as you fix every error. It checks your schema, so it can't tell whether a policy matches what you meant, and it doesn't act as a second user to test reads and writes. Add a human review before you take payments or store personal data.
How do I check my Supabase RLS policies?
Run the Security Advisor, then test as each role: sign out and try reads and writes with your public key, then sign in as user A and try to read or change user B's rows. Test inserts and updates, not just selects. Tools such as SupaSecure, RLS Guard and AuditYourApp automate parts of this.
Do I need to give a checker access to my database?
Not always. URL-based scanners use only what your front end already exposes. RLS Guard asks you to paste the result of a read-only query. Monitoring tools such as RowShield need a connection string with catalog-read access. Our Supabase Data-Leak Check uses exported policies or read-only dashboard access.
How much does a Supabase security check cost?
Free for the Security Advisor and open-source CLIs; $19 to $49 for one-off automated scans; free to $99 a month for monitoring (RowShield has a free daily tier); $99 for our human review ($249 with fixes) and $499 for AuditYourApp's expert review, as listed on each vendor's site on 18 October 2026.
How this guide was made: researched and drafted with AI assistance, then every price and claim was checked against the linked source on 18 October 2026. Editorial responsibility: ChikuOS. Spotted something out of date? Email hello@chikuos.com and we'll correct it.