SniffPupFree Supabase RLS policy explainer (paste SQL)
Row level security decides who can read and change each row through your Supabase API. One using (true) left over from a tutorial can open a whole table. Paste your policies and get each risky one explained in plain English, with what to change.
Runs in your browser. Nothing you paste is sent to SniffPup or stored. Paste schema and policies only, never keys or data.
What this checks
- Row level security off: public tables in your SQL that never get
enable row level security, so anyone with your project URL and anon key can read and change them. - Always-true policies:
using (true),with check (true),1 = 1and checks that only ask whether someone is signed in, for reads, inserts, updates and deletes, and who they open the table to. - Policies that trust user_metadata: users can edit their own metadata, so they can give themselves access.
- Views and functions that skip your policies: public views without
security_invoker, views overauth.users, and security definer functions without a fixedsearch_pathor still callable by signed-out visitors. - Storage: select policies that let people list every file in a bucket.
- Housekeeping: several permissive policies for the same action, and
auth.uid()calls that run once per row.
What it can't tell you
- It only reads what you paste. It doesn't connect to your database, so it can't see grants, data, settings or anything you left out.
- It can't tell whether a table is meant to be public. A readable product catalog is fine; a readable orders table isn't.
- It doesn't understand every policy. Complex conditions, custom functions and roles other than anon and authenticated aren't judged.
- No issues found is never proof of security. Test your policies signed out and as a second user.
Get your policies
- In the Supabase dashboard, open the SQL editor and run
select * from pg_policies;then copy the result as JSON or CSV. - Or paste your migration files from
supabase/migrations, or a schema dump of the public schema. - Or paste the JSON from Supabase's database advisors (for example from the Supabase CLI's
supabase db advisors).
Then check the live site
Policies are half the picture. The free scan checks what a stranger actually gets from your deployed app: keys in your JavaScript, tables readable with your anon key, public files and headers.
This runs SniffPup's normal free scan, so you get the whole report, not just this one check. Supabase results are listed as “Anyone can read your Supabase table …” and leaked-key findings. The free report lists every issue it finds with its severity, plus the full fix free for every critical issue (with no critical, one other fix). Only scan sites you own or are authorized to test. What the scanner does and never does.
More: Supabase exposed data checker and the vibe-coded app security checklist.
Questions
Is my SQL sent to SniffPup?
No. The explainer runs in your browser. What you paste isn't uploaded, logged or stored, and the page makes no request when you press Explain. Paste schema and policies only, never keys or table data.
What can I paste?
Schema or migration SQL (create table, alter table … enable row level security, create policy, create view, create function), the result of select * from pg_policies as JSON or CSV with its header row, or the JSON from Supabase's database advisors.
Does it connect to my database?
No. It only reads the text you paste, so it can't see grants, data, or anything you didn't include. To see what a stranger can reach on your live site, run the free scan below.
Does a clean result mean my policies are right?
No. It flags common mistakes, like policies that are always true, tables without row level security and policies that trust user-editable metadata. Test your policies signed out and as a second user too.
Do I get AI fix prompts here?
This page explains each problem and what to change, with example SQL. Copy-ready prompts for Lovable, Cursor, Bolt and Claude Code come with the Full Fix Report and paid plans, for the findings on your live site.