Supabase Security Advisor
Catching Supabase-specific mistakes such as public tables with row level security disabled.
Last updated
- Free tier
- Unknown
- Checked
- 2026-10-13
What the public pages say
This is the tool that matches the most common vibe-coded Supabase failure. The docs say advisors flag misconfigured RLS policies, among other checks. One documented check, rls_disabled_in_public, warns that a table in the public schema without row level security can be created, read, updated, and deleted by anyone with the project URL.
Run it before you share the app. Then read the finding. A warning you dismiss because "the app needs that table" is how the open table ships. The advisor does not write the policy for you, and it does not apply to a secret key, which bypasses RLS.
Free tier
Supabase's advisor docs describe Health, Security, and Performance advisors in Studio, via the CLI command `supabase db advisors`, via MCP, and via the Management API. The page does not list a separate price, and it does not say whether every billing plan includes the advisor. Check your project before you rely on it.
Not stated on the vendor's site
- Whether the Security Advisor is limited to a paid Supabase plan.
Sources
Markdown version · Canonical page: https://shipsecurely.dev/tools/supabase-security-advisor