SniffPupSupabase Security Advisor vs SniffPup
Last checked: October 19, 2026. Everything we say about Supabase Security Advisor comes from its own public pages, fetched that day and linked below. Pages change, so check them before you decide. Spot something out of date? Email support@sniffpup.com and we'll fix it.
If your app runs on Supabase, Security Advisor is the first place to look, and it's already in your dashboard. SniffPup isn't a replacement for it. SniffPup looks at the other side: what your live website hands to every visitor. Here's how the two fit together.
What Supabase Security Advisor does well
- It ships with Supabase. The docs list Studio, an MCP get_advisors tool, the CLI (supabase db advisors) and the Management API, so you or your coding agent can run it anywhere.
- It reads your real database from the inside: tables with RLS disabled, RLS enabled with no policies, always-true policies like USING (true), policies that rely on user-editable user_metadata, security definer views, and security definer functions anyone can call.
- It catches subtle things that are easy to miss, like sensitive-looking columns in tables without RLS, public buckets whose policies make files listable, and tables visible in your GraphQL schema.
- Each lint comes with a plain explanation, most with the SQL to fix it, and the docs are upfront about false positives.
In Supabase Security Advisor's own words
“Advisors are deterministic checks that ship with the platform. They flag health, security, and performance issues in your project, such as elevated error rates, misconfigured RLS policies, or missing indexes.”
supabase.com/docs/guides/database/database-advisors, fetched October 19, 2026
“Anyone with your project URL can read, edit, and delete all data in this table because Row-Level Security is not enabled.”
supabase.com/docs/guides/database/database-advisors, fetched October 19, 2026
“Some findings may be intentional, so check them against your intended schema and access model before you change anything.”
supabase.com/docs/guides/database/database-advisors, fetched October 19, 2026
What SniffPup adds
- SniffPup adds the outside view: it checks the website your users load, where Security Advisor doesn't look. That includes service_role or sb_secret keys shipped in your JavaScript (which bypass RLS entirely), other secret keys in your HTML and bundles, public /.env and /.git files, and public source maps.
- SniffPup also checks your site's security headers, cookie flags and HTTPS redirect, and what AI crawlers can read.
- On Pro, after you verify you own the domain, SniffPup adds a read-only test from the outside: with your public anon key, it counts which of up to 30 tables an anonymous visitor can actually read (row counts only, never row data) and which storage buckets are public. That's a practical double-check on the policies Security Advisor reviews.
- SniffPup re-scans on a schedule (weekly on Solo and Starter, daily on Pro) and alerts you when something new shows up on the live site.
Side by side
| SniffPup | Supabase Security Advisor | |
|---|---|---|
| What it reads | Your live website, passively, like any visitor | Your Supabase project's own schema, policies, functions and settings |
| Where it runs | sniffpup.com, from a URL | Supabase Studio, MCP, CLI and Management API (per Supabase docs) |
| RLS policies | Free scan can't see them; Pro deep check tests which tables the anon key can read after ownership verification | Reads them directly: RLS disabled, no policies, permissive policies and more |
| Keys in your frontend | Flags service_role/sb_secret and other secret keys in HTML and JavaScript | Not what it's for (it checks your Supabase project, not your website's files) |
| Cost | Free scan; one-time $19 Full Fix Report (every finding plus 30 days of re-scans, no subscription); Solo $9/mo, Starter $19/mo, Pro $39/mo. | Ships with the Supabase platform |
When to use Supabase Security Advisor instead
- Always, if you use Supabase. Open Security Advisor before you launch and after every schema change. It sees things no outside scan can.
- You want to check write policies (WITH CHECK), functions, views, GraphQL exposure or user_metadata in policies. Those are database-side questions.
When SniffPup fits
- After Security Advisor is clean, to check the other half: what your published site exposes, especially a service_role key that slipped into your frontend.
- You built on Lovable, Bolt or Cursor and want plain-English fixes you can paste back into your AI tool.
- You want scheduled outside re-scans of your live site.
FAQ
Do I need SniffPup if I use Supabase Security Advisor?
They answer different questions. Security Advisor checks your database configuration from the inside; SniffPup checks what your live website exposes from the outside, such as a service_role key in your JavaScript or a public .env file. Most Supabase apps benefit from both.
Can SniffPup see my RLS policies?
No. The free scan never queries your database. SniffPup's Pro deep check uses your public anon key, read-only and only after you verify the domain, to count which tables an anonymous visitor can read. To review the policies themselves, use Security Advisor.
Does a clean Security Advisor and SniffPup result mean my app is secure?
No tool can promise that. Together they cover common database misconfigurations and common outside exposures, but not your server logic or everything behind a login.
Sources (fetched October 19, 2026): supabase.com/docs/guides/database/database-advisors. SniffPup details: how the scanner works, how scoring works, pricing.
A clean report is not a guarantee of security.