Badge
Checked with ShipSecurely
This badge means the owner ran ShipSecurely's read-only exposure check at some point. It is not a security guarantee or an audit. It checks only what the anon key can reach for the tables tested. Results can change after any schema or policy change.
The badge does not say a project is secure, verified, or that it passed a review.
A count of zero rows can mean the table is empty, or that a policy hid every row. An empty bucket list means this key did not list any buckets. It does not prove every file is private.
Last updated
How to get the badge
Run the Supabase exposure checker on a project you own or are allowed to test. Paste the project URL, the public anon key, and the table names. The check runs in your browser. The badge is offered on the results only when the report is clean.
Clean means every table that was tested came back with no rows visible to the anon key, and the key listed no buckets. The badge stays hidden when a table had rows the anon key could read, when a bucket was listed, or when the check errored or was partial. A partial check includes a timed-out request, a skipped name, an inconclusive count, a bucket list that could not be read, or a list cut off at 50 names. A refused catalog still allows the badge: the anon key often cannot list tables, and the names you pasted are what get checked. For catalog discovery, only a failed listing hides the badge.
Snippets
The badge is self-reported. Anyone can copy the snippet, so it is not proof that a scan happened. Copy the HTML onto a site, or the Markdown into a README. The image links back to the checker. The link uses ref=badge and utm parameters so a click can be counted. Those parameters are not a project name or an email address.
HTML
<a href="https://shipsecurely.dev/tools/supabase-rls-checker?ref=badge&utm_source=badge&utm_medium=embed&utm_campaign=checked-badge"><img src="https://shipsecurely.dev/checked.svg" width="236" height="32" alt="Checked with ShipSecurely"></a>
Markdown
[](https://shipsecurely.dev/tools/supabase-rls-checker?ref=badge&utm_source=badge&utm_medium=embed&utm_campaign=checked-badge)
The image URL is the same for every project. It has no project name, no date, and nothing from the scan. ShipSecurely does not store a result in order to show the badge.