defencecore
Create account ↗
  1. EmailDeliver report
  2. ConnectAuthorize Supabase
  3. ScanRead metadata
  4. ReportReview findings
  5. MonitorStay protected
FREE SUPABASE SECURITY SCANNER

Find Supabase security issues before they become incidents.

Run a read-only scan for unsafe RLS policies, exposed database tables, and public Supabase Storage buckets. See the findings immediately and get a report by email.

Do not scan projects containing sensitive data or PII.This includes personal, health, payment, government ID, authentication-secret, children's, regulated, or confidential data—even if you expect the scanner to read only metadata.
No credit card. The scan takes about 30 seconds.
  • Supabase RLS and policy checks
  • Supabase Storage exposure
  • Prioritized database security fixes
WHAT THE FREE SCANNER CHECKS

A focused Supabase database security check.

The Supabase scanner reviews Postgres and Storage metadata for access-control mistakes. It uses fixed checks, reports the evidence, and leaves your application data untouched.

Supabase RLS and policies

Find tables without Row Level Security, API grants on unprotected tables, missing applicable policies, and policies that allow every row.

Supabase Storage exposure

Identify public Storage buckets whose objects can be served without an authenticated download request.

Read-only Supabase Postgres scan

Inspect catalogue metadata through a server-owned read-only query—never application rows, generated SQL, migrations, or settings.

SUPABASE SECURITY SCANNER FAQ

Before you connect a project.

How does the free Supabase security scanner work?

Connect through Supabase OAuth, choose a project, and Defencecore runs fixed, read-only catalogue checks. It then shows the findings in your browser and emails the same report.

Does the scanner need my Supabase API key?

No. Defencecore uses read-only Supabase OAuth and never asks for a service-role key, database password, personal access token, or SQL from your browser.

What does the Supabase RLS checker test?

The scan checks for tables without Row Level Security, exposed API grants, missing or unsafe policies, unconditional policy expressions, and public Supabase Storage buckets.

Does the scanner read or change my application data?

No. The scanner inspects Postgres catalogue and Storage metadata using a server-owned read-only query. It does not select application rows or write migrations, policies, or settings.