Help centre
How RowShield works, what every finding means, and what happens to your data. Written for the person with a question at an inconvenient hour; everything here is also served as markdown for coding agents via /llms-full.txt.
Start here
What RowShield does, what it never touches, and your first scan.
What RowShield does and what it deliberately does not do
Continuous monitoring for Supabase backends: what the scanner reads, what it never touches, and the honest limits of automated coverage.
Run your first free audit in five minutes
Point the free probe at a deployed app and read the report. No account, no connection string, and nothing is written to your project.
Connect a project: credentials, scans and revoking
What happens to your connection string, exactly which statements a scheduled scan runs, and how to end RowShield's access when you choose to.
RowShield glossary: the words we use, defined once
The vocabulary used across the dashboard, alerts and these pages: finding, transition, disposition, drift event, health score, remediation SQL and probe.
Scans
What a scan reads, how often it runs, and what the health score means.
The free probe: anon key only, and what emptiness means
The free check uses only the public anon key and read-only requests. Here is what it can prove, and why an empty response proves nothing.
Connected scans: six fixed queries over pg_catalog
A connected scan reads pg_catalog views and bucket metadata through six fixed queries, exports them for audit, and never selects your data.
Scan schedules: daily, hourly and 15-minute intervals
How often your projects are scanned on each plan, how due is decided, and how the Scan-now button fits around the schedule.
How the health score is calculated
The health score starts at 100 and loses points per open finding, with saturating penalties. What moves it, and what does not.
CLI reference: rowshield scan and rowshield probe
rowshield scan and rowshield probe: flags, exit codes 0, 1 and 2, and a continuous-integration recipe that tells failures apart.
Live scans: the Scan-now button and the SSE stream
Scan now queues a run immediately and streams progress to the open page over server-sent events. Retried scans emit nothing twice.
Findings
Every rule explained, what we suppress on purpose, and remediation SQL.
Every shipped rule at a glance
All nine shipped rules with one-line summaries and links to the full documentation for each. Nothing is counted as coverage that no rule performs.
Severity levels: what critical, high and medium mean
Which rules are critical, high or medium, and why the ordering sometimes disagrees with a reasonable first impression.
Three core RLS bugs that look alike from outside
RLS disabled, RLS with no policies, and a policy that always evaluates true are three different failures. Each one needs a different fix.
False positives we suppress on purpose, and why
System schemas, RESTRICTIVE tautologies, service_role-only policies and empty probe responses are suppressed deliberately. The reasons, in full.
Remediation SQL: generated from columns, applied safely
Remediation SQL is generated from your actual columns and always includes FORCE ROW LEVEL SECURITY. How to apply it, and undo it, safely.
Performance findings: predicates and per-row auth calls
Unindexed policy predicates and bare auth.uid() calls are the two performance rules. What they mean and the size of the win, stated honestly.
Disputing a finding
Think a finding is wrong? Email info@getveristria.com with the details and an engineer re-checks it against your snapshot and the rule.
Monitoring & alerts
Transition-only alerting, destinations, thresholds and drift alerts.
Why alerts fire only when a finding changes
RowShield alerts only when a finding is created, regressed or resolved. Why a constant state pages nobody, and why a retried scan cannot send the same alert twice.
Alert destinations and severity thresholds
HTML email, Slack Block Kit messages, Discord embeds and generic webhooks. Each destination carries its own severity threshold, and availability depends on plan.
Drift alerts: appeared, came back, disappeared
How schema drift is reported between scans — objects that appeared, came back or disappeared — and how to read a drift diff without guessing at what moved.
When a resolved finding comes back
A regressed finding means a resolved problem returned. What the transition tells you about release habits and process, and how to make fixes stick for good.
Plans & billing
What each plan includes and how limits are enforced.
Plans, limits and what is never withheld
Free, Indie, Team and Growth compared on the things that actually differ: project counts, scan frequency, alert channels and seats.
Entitlements: one function decides everything
entitlementsFor(plan, status) is a pure function consulted by both the interface and the API. How limits are computed and clamped, and why they cannot drift.
Billing states and what each means for access
Which subscription statuses keep a paid plan working, why past_due keeps scanning through dunning, and when canceled or unpaid steps access down to Free.
Seats: who can join an organisation
Seat limits by plan: one seat on Free and Indie, unlimited seats on Team, and how invitations behave when an organisation changes size or plan.
Security
How credentials are stored, what the probe can and cannot do, and what we retain.
How database credentials are stored
Connection strings are envelope-encrypted with AES-256-GCM under an optional KMS-held key, bound to your organisation and project by additional authenticated data.
Why we say zero data access, and how it is built
Six fixed introspection statements over pg_catalog and bucket metadata, zero bind parameters, exported as INTROSPECTION_QUERIES so anyone can audit what runs.
Probe safety: methods and refused addresses
The external probe issues GET, HEAD and OPTIONS only and refuses loopback, RFC1918, link-local, CGNAT and cloud-metadata addresses, re-checked on every redirect hop.
What we keep, and what we never retain
Leaked rows are reported as column names and counts, keys as fingerprints, webhook URLs masked, errors as fixed phrases. Deliberately thin retention, itemised.
Troubleshooting
Connection failures, silent results, alert delivery and disagreeing with the dashboard.
Connection failures: the network-error phrase catalogue
Every fixed network-error phrase RowShield can show, what each one means, and why raw driver messages are never passed through.
Empty results explained: the three meanings of silence
An empty response has three possible meanings. How RowShield tells denied-by-default, genuinely empty and filtered-by-policy apart.
When RowShield and the Security Advisor disagree
RowShield tests runtime behaviour; the dashboard advisor inspects configuration. Here is how to adjudicate when the two disagree.
Infinite-recursion policy errors and the helper fix
Diagnose SQLSTATE 42P17 infinite-recursion policy errors and apply the security definer helper-function pattern, with a worked example.
Alerts not arriving: threshold, destination, dedupe
Most missing notifications come down to threshold filtering, destination health or deliberate dedupe. Work through the checks in order.
Revoking access: disconnecting a project
What happens when you disconnect a project: probing stops immediately, credentials are discarded and stored history is deleted on schedule.
FAQ
The questions we are asked most, answered plainly.
Reference
Changelog, status, disclosure policy and the roadmap.
Changelog
Product-visible changes appear here newest first, each dated and tagged by surface. The current entry covers the August 2026 launch window.
Status and incident communication
Where posture and product status live, what an incident notice contains and the standard we hold ourselves to when things go wrong.
Disclosure policy for security reports
How to report a vulnerability in RowShield, what to expect from us, how researchers are credited and why this stays independent of Supabase.
Roadmap: committed direction, no promised dates
Committed direction on a GitHub Action, a public scan API and security definer analysis. Sequencing may shift; dates are not promised.
Contact
How to reach support and how to report a security issue.
Not answered here? Email info@getveristria.com — a person reads it.