---
name: Supabase Security Advisor
slug: supabase-security-advisor
url: https://supabase.com/docs/guides/database/database-linter
category: Database
bestFor: "Catching Supabase-specific mistakes such as public tables with row level security disabled."
freeTier: unknown
price: "Not stated"
checks:
  - supabase-rls
freeTierNote: "Supabase's advisor docs describe Health, Security, and Performance advisors in Studio, via the CLI command `supabase db advisors`, via MCP, and via the Management API. The page does not list a separate price, and it does not say whether every billing plan includes the advisor. Check your project before you rely on it."
verifiedOn: "2026-10-13"
sources:
  - https://supabase.com/docs/guides/database/database-linter
unknowns:
  - "Whether the Security Advisor is limited to a paid Supabase plan."
---

This is the tool that matches the most common vibe-coded Supabase failure. The docs say advisors flag misconfigured RLS policies, among other checks. One documented check, `rls_disabled_in_public`, warns that a table in the `public` schema without row level security can be created, read, updated, and deleted by anyone with the project URL.

Run it before you share the app. Then read the finding. A warning you dismiss because "the app needs that table" is how the open table ships. The advisor does not write the policy for you, and it does not apply to a secret key, which bypasses RLS.