v0, Cursor, Claude, and Bolt make it easy to ship Supabase apps in a weekend. They also happily leave USING (true) in every RLS policy. I scanned 100 random Supabase projects on GitHub — 22% leak user data anonymously. I built this auditor after I found 14 critical leaks in my own production CRM. Run it on yours.
ALTER TABLE … ENABLE RLS, REVOKE ALL ON … FROM anon, ALTER FUNCTION … SET search_path. Paste into the Supabase SQL editor.BEGIN; … ROLLBACK; first to verify, then commit.On October 30, 2026, Supabase enforces the new default that tables in public no longer auto-expose to the Data API on EXISTING projects. If you've been on Supabase >6 months, you almost certainly have leaky tables right now. After Oct 30 your app may break in unexpected ways if you don't audit and fix proactively.
I built and shipped supabase-security (open source MIT) — the only auditor with active anon-key probe + MCP server for AI coding agents. SaaS competitors charge $49–499/month for what's essentially metadata reads. This is the manual + faster version of that, run by me directly.
What permissions do you need? A Supabase Personal Access Token from supabase.com/dashboard/account/tokens. Read access is enough for the audit (the auditor never writes to your project).
Will you keep the token? No. Used only for the audit run. Deleted from my machine after the report is delivered. You can rotate it the moment you receive the report.
What if you find nothing? Money-back. I've never run this on a project that's been live >6 months and found zero issues, but if it happens to you, you don't pay.
Do you offer the fix too? The report ships with copy-paste SQL on every finding. If you want me to apply the fixes for you, that's a separate $199 add-on (we'll discuss after you see the report).
I'd rather just use the open-source tool. Go ahead — github.com/Perufitlife/supabase-security-skill. The $99 saves you the install + interpretation + writing the executive summary for your team. Worth it for some, not for others.