🛡️ Supabase RLS Doctor

Find Supabase access-control gaps before they expose customer data

Audit local Supabase SQL, migrations, policies, storage rules, and client code for RLS gaps. Get severity-ranked evidence, proposed fixes, and verification steps without connecting to or changing the live project.

Spot the mistakes that create real exposure

Flag missing or disabled RLS, public table exposure, unsafe true predicates, service-role references, overbroad grants, tenant-isolation gaps, insecure storage rules, migration drift, and frontend/backend boundary mistakes.

Get evidence you can act on

Every confirmed finding includes exact file and line evidence, impact, a proposed remediation, and a verification step. Hypotheses and missing evidence stay separate so a heuristic match is never presented as proof of security.

Run locally and read-only by default

The bundled scanner uses only the Python standard library. It requires no paid API, credentials, data transmission, dependency install, live Supabase connection, SQL execution, or automatic policy change.

Know what still needs manual review

The scanner is heuristic, dashboard-only policies require current account evidence, and the guided checklist clearly marks storage, ownership, tenant, and deployment settings that still need verification.