# RowShield

> Continuous security monitoring, schema-drift detection and automated RLS auditing for Supabase backends.
> Built for backends generated by Cursor, Lovable, Bolt, Claude Code and v0.

## Core product
- Free public probe, no signup, read-only: POST /api/v1/probe/public
- Continuous monitoring: scheduled catalog audits over a Postgres connection, with drift diffing
- Alerts: Slack, Discord, email, generic webhook — fired on transitions, not on every scan
- Pricing: Free (1 project, daily) · Indie $29/30 days (3 projects, hourly) · Team $99/30 days (15 projects, 15-minute)

## Detection rules that ship today
These are the complete set. Anything not listed here is not detected.

### Catalog rules (require a connected project)
- RLS_DISABLED (critical): Row Level Security disabled → /docs/rules/rls-disabled
- RLS_NO_POLICIES (high): RLS enabled but no policies → /docs/rules/rls-no-policies
- RLS_TAUTOLOGY (critical): Policy always evaluates to true → /docs/rules/permissive-policy
- MISSING_WITH_CHECK (high): Write policy without WITH CHECK → /docs/rules/missing-with-check
- UNINDEXED_RLS_PREDICATE (medium): RLS predicate column is not indexed → /docs/rules/unindexed-rls
- PUBLIC_BUCKET_EXPOSURE (high): Storage bucket is public → /docs/rules/public-bucket-exposure
- RLS_UNWRAPPED_AUTH_CALL (medium): auth.uid() not wrapped in a subquery → /docs/rules/unwrapped-auth-uid

### Probe rules (public, no credential)
- SERVICE_ROLE_KEY_EXPOSED (critical): service_role key shipped to the browser → /docs/rules/service-role-exposure
- ANON_TABLE_READABLE (critical): Table readable with the anon key → /docs/rules/anon-table-readable

## Not detected
RowShield does not currently check SECURITY DEFINER views, anon-callable
SECURITY DEFINER functions, or function search_path mutability. The Supabase
Security Advisor covers those; manual queries are documented at
/solutions/security-definer-view-bypass.

## Guides
- RLS disabled on a public table: the most common Supabase leak → /solutions/rls-disabled-on-public-table
- The migration that added a table and forgot RLS → /solutions/new-table-shipped-without-rls
- USING (true): the policy that protects nothing → /solutions/using-true-policy-everything-true
- WITH CHECK (true): anyone can write anything → /solutions/with-check-true-write-hole
- INSERT policies without WITH CHECK let anyone write as anyone → /solutions/insert-policy-no-with-check
- RLS enabled, zero policies: silently everything-denied → /solutions/rls-enabled-no-policies-locked-out
- Policies scoped to service_role are decoration → /solutions/policy-scoped-to-service-role-only
- RESTRICTIVE policies: the modifier people accidentally grant with → /solutions/restrictive-policy-confusion
- Without FORCE RLS the table owner bypasses everything → /solutions/owner-bypasses-rls-no-force
- auth.uid() returning null in the wrong context → /solutions/auth-uid-null-in-policies
- Two permissive policies are OR’d together — and that surprises people → /solutions/multiple-policies-permissive-union
- SECURITY DEFINER functions with an unset search_path → /solutions/function-search-path-bypass
- Direct GRANTs to anon that sidestep RLS thinking entirely → /solutions/grants-to-anon-role-directly
- Views that execute with owner rights and skip policy checks → /solutions/views-without-security-invoker
- The Supabase security gaps Lovable apps ship with → /solutions/lovable-supabase-security-gaps
- World-readable tables in a Lovable build — and the one request that proves it → /solutions/lovable-app-world-readable-tables
- Bolt.new builds and the policies that were never written → /solutions/bolt-new-supabase-policies-missing
- Cursor-written migrations and the RLS line that never appeared → /solutions/cursor-migration-forgot-rls
- Claude Code + Supabase MCP: fast schema, slow policy → /solutions/claude-code-supabase-mcp-schema-drift
- Replit frontends and everything the anon key can reach → /solutions/replit-supabase-anon-abuse
- Taking a v0 + Supabase prototype to production safely → /solutions/v0-supabase-prototype-hardening
- Translating Firebase rules thinking into RLS thinking → /solutions/firebase-to-supabase-migration-rls
- Edge functions hold service_role — verify the boundary actually holds → /solutions/supabase-edge-function-service-role
- The server/client key split done wrong in Next.js + Supabase → /solutions/nextjs-supabase-ssr-key-split
- FlutterFlow + Supabase: the RLS half the tutorial skipped → /solutions/flutterflow-supabase-rls
- Internal tools pointed straight at PostgREST → /solutions/bubble-retool-supabase-direct
- Anyone can list my users table → /solutions/supabase-users-table-readable
- My API returns data with no login at all → /solutions/table-returns-data-unauthenticated
- The dashboard says protected, but the table is still readable → /solutions/dashboard-says-protected-still-readable
- Your storage bucket is public — so are all of its images → /solutions/storage-bucket-public-images
- An open storage.objects policy is a public bucket with extra steps → /solutions/storage-objects-open-policy
- Queries got slower the day RLS went on → /solutions/slow-queries-after-adding-rls
- The bill spiked and the only change was policies → /solutions/supabase-bill-spike-rls
- The same Security Advisor warning keeps coming back → /solutions/security-advisor-warning-returns
- You fixed it Monday; it was back by Friday → /solutions/finding-regression-fixed-weekly
- What a RowShield health score actually measures → /solutions/health-score-explained
- Schema drift in Supabase: what moves, what breaks, what watches → /solutions/supabase-schema-drift-guide
- The new column your policy never mentioned → /solutions/column-added-breaks-policy
- Renames that quietly unhook a policy predicate → /solutions/renamed-column-nulls-protection
- The migration that recreated the table without its policies → /solutions/migration-dropped-policy
- Restores that resurrect last month’s holes → /solutions/restore-rolled-back-protections
- Staging and production disagree about who can read → /solutions/drift-between-staging-production
- Policy drift versus the advisor: point-in-time versus continuous → /solutions/policy-drift-vs-advisor
- Anatomy of a RowShield drift alert → /solutions/what-drift-alerts-contain
- Unindexed RLS predicates: the index your policy is begging for → /solutions/unindexed-rls-predicate-fix
- Wrapping auth.uid(): the InitPlan pattern, explained honestly → /solutions/auth-uid-initplan-wrapper
- RLS patterns that survive millions of rows → /solutions/rls-on-large-tables
- Per-row versus per-statement: how policy conditions really run → /solutions/policy-per-row-vs-statement
- Index strategy for org_id-style multi-tenant policies → /solutions/indexing-for-multi-tenant-rls
- Thinking like an RLS cost calculator → /solutions/rls-cost-calculator-thinking
- A Supabase storage audit you can run in ten minutes → /solutions/supabase-storage-security-check
- Signed URLs or a public bucket: deciding properly → /solutions/signed-urls-vs-public-bucket
- Exactly what an anon key can do before you write a policy → /solutions/anon-key-capabilities-list
- The two-key mental model, once and for all → /solutions/service-role-vs-anon-reference
- Rotating a service_role key that got out: rotate first → /solutions/leaked-service-role-rotation
- sb_publishable_ keys and the new API-key hierarchy → /solutions/publishable-keys-new-model
- Row Level Security alongside an external auth provider → /solutions/rls-with-third-party-auth
- Realtime authorisation and the policies people forget → /solutions/realtime-channels-and-rls
- Supabase security for solo founders: a one-person pass that holds → /solutions/solo-founder-supabase-security
- Supabase security across client projects: an agency baseline → /solutions/agency-manage-client-supabase
- From prototype to production: the Supabase checklist → /solutions/prototype-to-production-checklist
- Health data isolation on Supabase: configuration you can defend → /solutions/healthcare-app-data-isolation
- Student data on Supabase: scoping enrolments, marks and messages → /solutions/education-platform-student-data
- Your internal tool is reachable by the whole internet → /solutions/internal-tools-world-readable
- Multi-tenancy on Supabase: policy patterns that scale → /solutions/multi-tenant-rls-patterns
- Can tenant A read tenant B? A test you can run tonight → /solutions/b2b-saas-tenant-leak-test
- Forum databases on Supabase: public by design, private by policy → /solutions/community-forum-database-posture
- Chat history is sensitive: securing an AI backend on Supabase → /solutions/ai-chatbot-startup-backend
- Listings are public; everything around them is not → /solutions/directory-marketplace-listings
- An open contact table reads like a customer list, because it is one → /solutions/crm-contact-tables-exposed
- Telemetry writes: RLS on IoT ingest tables → /solutions/iot-ingest-tables-rls
- Inheriting a Supabase project: the first-week audit → /solutions/consulting-handover-supabase-audit
- What a SOC 2 auditor asks about your Supabase RLS posture → /solutions/soc2-evidence-supabase-rls
- Access-control posture for GDPR-minded teams on Supabase → /solutions/gdpr-access-control-posture
- Demonstrating who changed your database policies, and when → /solutions/audit-trail-for-policy-changes
- Security advisor vs continuous monitoring, drawn precisely → /solutions/security-advisor-vs-continuous-monitoring
- Linting policy SQL versus probing the live project → /solutions/sql-linter-vs-live-probe
- pgTAP-style test harnesses versus managed RLS monitoring → /solutions/pgtap-vs-continuous-rls-testing
- A fifteen-minute manual Supabase audit — and where it stops → /solutions/manual-pg-audit-checklist
- Free ways to audit a Supabase project, honestly compared → /solutions/free-supabase-security-audit-options
- A free Supabase RLS audit: paste a URL, read the findings → /solutions/free-supabase-rls-audit
- Probe your live app: what its own public key gives away → /solutions/probe-my-live-app
- Is my Supabase secure? An honest answer, and how to find yours → /solutions/is-my-supabase-secure
- Checking whether RLS is enabled: one query, read honestly → /solutions/how-to-check-rls-enabled
- Listing every RLS policy: pg_policies, column by column → /solutions/how-to-list-rls-policies
- Testing RLS as the anon caller, not as the admin → /solutions/test-rls-as-a-caller
- Tautological policies: when RLS is switched on and says nothing → /solutions/what-is-tautological-policy
- Will enabling RLS break my app? What actually changes → /solutions/does-enabling-rls-break-app
- The Supabase security checklist, complete and current → /solutions/supabase-security-checklist
- RLS glossary: every term, in plain language → /solutions/rls-glossary
- Why the same finding returns — and what finally breaks the cycle → /solutions/why-findings-repeat
- RowShield for agencies: every client backend, one pane → /solutions/rowshield-for-agencies
- Adding a policy check to your Supabase CLI workflow today → /solutions/supabase-cli-security-step
- A GitHub Actions RLS check: the design, and what works today → /solutions/github-actions-rls-check-planned
- Auditing preview deployments: the plan, and today's practice → /solutions/vercel-deploy-preview-audit-planned
- Slack alerts for RLS changes: contents, thresholds, cadence → /solutions/slack-alerts-rls-changes
- Discord delivery for findings: embeds, thresholds, dedupe → /solutions/discord-webhooks-findings
- Driving scans from your own tooling: today and planned → /solutions/api-driven-scans-planned
- Policy-as-code habits for Supabase: Terraform and beyond → /solutions/terraform-supabase-policies
- The migration review habit that stops most Supabase drift → /solutions/migration-review-discipline
- Prevent Supabase RLS bypass → /solutions/supabase-rls-bypass-prevention
- Detect a service_role key in your client bundle → /solutions/service-role-key-leak-detection
- Why your Supabase bill spikes after adding RLS → /solutions/unindexed-rls-performance
- Check whether your Lovable app is leaking data → /solutions/lovable-supabase-data-leak
- Bolt.new shipped tables without RLS → /solutions/bolt-supabase-rls-missing
- Audit the Supabase policies Cursor wrote → /solutions/cursor-supabase-security
- Detect Supabase schema drift after migrations → /solutions/schema-drift-detection-supabase
- SECURITY DEFINER views and functions that bypass RLS → /solutions/security-definer-view-bypass
- What the Supabase Security Advisor does not do → /solutions/supabase-security-advisor-limitations
- Continuous RLS monitoring for Supabase → /solutions/continuous-rls-monitoring

## Support centre
- Start here: /help/start-here — What RowShield does, what it never touches, and your first scan.
- Scans: /help/scans — What a scan reads, how often it runs, and what the health score means.
- Findings: /help/findings — Every rule explained, what we suppress on purpose, and remediation SQL.
- Monitoring & alerts: /help/monitoring — Transition-only alerting, destinations, thresholds and drift alerts.
- Plans & billing: /help/plans — What each plan includes and how limits are enforced.
- Security: /help/security — How credentials are stored, what the probe can and cannot do, and what we retain.
- Troubleshooting: /help/troubleshooting — Connection failures, silent results, alert delivery and disagreeing with the dashboard.
- FAQ: /help/faq — The questions we are asked most, answered plainly.
- Reference: /help/reference — Changelog, status, disclosure policy and the roadmap.
- Contact: /help/contact — How to reach support and how to report a security issue.

## Comparisons
- RowShield vs Supabase Security Advisor: The Security Advisor is a free dashboard linter that reports common configuration problems at the moment you open it. RowShield is a scheduled monitor that diffs every scan against the last one and alerts on changes between your dashboard visits. → /vs/vs-supabase-security-advisor
- RowShield vs Supabase db lint: `supabase db lint` is a free CLI command that runs the plpgsql_check static analyser against the functions in your database and prints what it finds. RowShield is a hosted monitor that scans policy posture, probes live anon behaviour and diffs every scan against the last. → /vs/vs-supabase-db-lint
- RowShield vs Supabase Log Explorer: The Log Explorer is the dashboard surface for querying Supabase platform logs — API, Postgres, auth and storage events — with ad hoc queries. RowShield is a scheduled auditor that inspects configuration, probes anon access and alerts on changes between scans. → /vs/vs-supabase-log-explorer
- RowShield vs Supabase Storage default policies: Supabase Storage ships template policies and sensible defaults so buckets work within minutes of creation. RowShield treats whatever is configured — templates included — as a hypothesis to verify: bucket visibility, anon reachability and drift are checked on every scan. → /vs/vs-supabase-storage-default-policies
- RowShield vs Firebase Security Rules: Firebase Security Rules are a declarative authorisation language evaluated by Firestore, Realtime Database and Cloud Storage on every request, with local emulation and unit testing. RowShield is a scheduled monitor that verifies Supabase PostgreSQL row level security: posture, live anon behaviour and drift. → /vs/vs-firebase-security-rules
- RowShield vs AWS Amplify auth rules: Amplify Data lets you declare authorisation on the schema with auth() directives, which the framework compiles into AppSync resolvers backed by AWS services. RowShield is a scheduled monitor that verifies Supabase PostgreSQL RLS: policy posture, live anon behaviour and drift. → /vs/vs-amplify-auth-rules
- RowShield vs PocketBase collection rules: PocketBase is a single-binary application with an embedded SQLite database; each collection carries API rules — listRule, viewRule, createRule and the rest — written as concise filter expressions. RowShield is a scheduled monitor that verifies Supabase PostgreSQL RLS posture, probes anon behaviour and alerts on drift. → /vs/vs-pocketbase-rules
- RowShield vs Appwrite permissions: Appwrite expresses authorisation as permissions attached to users, teams and documents, enforced by its services at the API boundary across databases, storage and functions. RowShield is a scheduled monitor that verifies Supabase PostgreSQL RLS: posture, live anon behaviour and drift. → /vs/vs-appwrite-permissions
- RowShield vs plpgsql_check: plpgsql_check is a free, open-source Postgres extension that statically analyses PL/pgSQL function bodies — resolving embedded SQL against the catalog and reporting defects before runtime. RowShield is a scheduled monitor over policy posture, live anon behaviour and drift across a Supabase project. → /vs/vs-plpgsql-check
- RowShield vs Squawk: Squawk is a linter for Postgres migrations: it flags dangerous or expensive DDL patterns before they merge, as a CLI and GitHub Action. RowShield is a scheduled monitor over the running Supabase project — policy posture, anon behaviour and drift after deploy. → /vs/vs-squawk
- RowShield vs sqlfluff: sqlfluff is a dialect-aware SQL linter and formatter: it parses SQL, enforces configurable style rules and applies autofixes, across many dialects and templaters. RowShield is a scheduled monitor over a live Supabase project — policy posture, anon behaviour and drift. → /vs/vs-sqlfluff
- RowShield vs sqlcheck: sqlcheck is a free, open-source research project that scans SQL scripts for anti-patterns documented in the database literature and reports where they appear. RowShield is a scheduled monitor over a live Supabase project — policy posture, anon behaviour and drift. → /vs/vs-sqlcheck
- RowShield vs pglinter: pglinter is a Postgres extension that lints the database from within: callable checks flag configuration anti-patterns and return the findings as result sets. RowShield is a scheduled monitor over a Supabase project — security posture, anon behaviour and drift, with pushed alerts. → /vs/vs-pglinter
- RowShield vs migra: migra is a free, open-source command-line tool that compares two PostgreSQL schemas and writes the SQL needed to turn one into the other. RowShield is a scheduled monitor that verifies who the running Supabase project can actually read, and alerts when that posture changes between scans. → /vs/vs-migra
- RowShield vs pg-schema-diff: pg-schema-diff is Stripe’s open-source Go library and CLI that diffs PostgreSQL schemas and generates migration plans designed to minimise locking, with warnings about hazardous statements. RowShield is a scheduled monitor that verifies the authorisation outcome of those migrations on a running Supabase project and alerts when it changes. → /vs/vs-pg-schema-diff
- RowShield vs Atlas: Atlas, by Ariga, is a schema-as-code tool: declare the desired database state, and the CLI plans and applies changes, with `atlas schema diff` documenting drift detection between desired and live schemas. RowShield is a continuous monitor for Supabase that treats policy, storage and key exposure as the state worth watching. → /vs/vs-atlas
- RowShield vs Bytebase: Bytebase is a serious database change-management platform: schema change workflows with review and approval, an audit trail, and drift detection against baselines across many database engines. RowShield is a continuous Supabase monitor that verifies policy posture and live anon behaviour between changes and alerts when either moves. → /vs/vs-bytebase
- RowShield vs Liquibase: Liquibase tracks database change through changelogs — declarative files applied in order — with paid tiers documenting drift detection that compares changelog expectations to the live database. RowShield is a continuous monitor for Supabase whose drift subject is authorisation: policies, storage, keys and observed anon behaviour. → /vs/vs-liquibase
- RowShield vs Flyway: Flyway applies numbered, versioned SQL migrations and records which versions ran; its Teams editions document drift detection comparing resolved migrations against the database. RowShield is a scheduled Supabase monitor whose checks target authorisation posture and live behaviour, independent of how migrations were applied. → /vs/vs-flyway
- RowShield vs apgdiff: apgdiff is a long-running open-source Java utility that reads two PostgreSQL dump files and prints the DDL statements needed to turn the first schema into the second. RowShield is a hosted monitor that scans a live Supabase project on a schedule, checks nine authorisation rules, probes the anon surface, and alerts when anything changes. → /vs/vs-apgdiff
- RowShield vs Prisma Migrate: Prisma Migrate generates SQL migrations from your schema.prisma and keeps the database aligned with it; db pull introspects a database back into the schema file. RowShield is a continuous Supabase monitor covering everything that model-first workflow cannot express: row level security, storage exposure, key leakage and observed anon behaviour. → /vs/vs-prisma-migrate
- RowShield vs Drizzle Kit: Drizzle Kit drives schema workflow for the Drizzle ORM: drizzle-kit generate creates migration files from schema changes and push applies a computed diff straight to the database. RowShield is a continuous Supabase monitor that checks the authorisation layer those workflows never touch — policies, storage, keys — and alerts when it moves. → /vs/vs-drizzle-kit
- RowShield vs Alembic: Alembic is the Python migration framework for SQLAlchemy: revisions are versioned scripts, and autogenerate compares your models’ metadata against the live database to propose a diff. RowShield is a continuous Supabase monitor covering what metadata does not describe — row level security, storage exposure, key leakage — and alerting when that layer changes. → /vs/vs-alembic
- RowShield vs Django migrations: Django migrations derive from model state: makemigrations diffs your models against recorded migrations, and migrate applies the result. RowShield is a continuous Supabase monitor for everything model state omits — row level security, storage exposure, key leakage — with a probe that tests what the anon key can actually read. → /vs/vs-django-migrations
- RowShield vs Rails ActiveRecord migrations: Rails ActiveRecord migrations evolve the database through a Ruby DSL and regenerate schema.rb as a running record of structure. RowShield is a continuous Supabase monitor for what the DSL and schema dump never describe: row level security, storage exposure, key leakage, and observed anon behaviour. → /vs/vs-rails-migrations
- RowShield vs dbmate: dbmate is a minimalist, language-agnostic migration tool: numbered .sql files with up/down sections, applied by a single binary. RowShield is a scheduled Supabase monitor that verifies the authorisation outcome of whatever applied those files — policies, buckets, keys, and what the anon key can actually fetch. → /vs/vs-dbmate
- RowShield vs golang-migrate: golang-migrate is the widely used Go migration CLI and library: paired up/down SQL files, applied in version order, embeddable in Go services. RowShield is a scheduled Supabase monitor that verifies the authorisation state those files produce — policies, buckets, keys — and alerts when any of it changes. → /vs/vs-golang-migrate
- RowShield vs node-pg-migrate: node-pg-migrate is a Node.js migration framework over node-postgres: migrations defined programmatically in JavaScript, run by CLI or library. RowShield is a scheduled Supabase monitor that checks what those migrations never express — row level security, storage exposure, key leakage — and probes what the anon key can actually read. → /vs/vs-node-pg-migrate
- RowShield vs pgTAP: pgTAP is a TAP-based unit-test framework running inside Postgres; teams write explicit assertions for policies and schema. RowShield is a scheduled monitor over the live catalog plus an anon-key probe, so verification happens without anyone maintaining a suite. → /vs/vs-pgtap
- RowShield vs pg_prove: pg_prove is the Perl-based runner that executes pgTAP suites and reports TAP results in pipelines. RowShield is not a runner at all — it is scheduled, centralised verification of live Postgres posture requiring no suite. → /vs/vs-pg-prove
- RowShield vs Testcontainers: Testcontainers spins up disposable Postgres instances per test run so integration tests exercise real SQL against real engine behaviour. RowShield continuously inspects and probes the deployed Supabase project itself. → /vs/vs-testcontainers
- RowShield vs Jest/Vitest + supabase-js test patterns: Hand-rolled tests drive supabase-js as anon/authenticated users against a real project, asserting what each identity may read or write. RowShield evaluates the whole catalog continuously and probes the deployed bundle — coverage without authorship. → /vs/vs-jest-supabase-tests
- RowShield vs SonarQube / SonarCloud: SonarQube/SonarCloud perform static analysis over repositories — quality gates, smells, dependency risks — with SQL awareness varying by edition. RowShield analyses the running database: catalog posture, anon-key behaviour, drift between scans. → /vs/vs-sonarqube
- RowShield vs Semgrep: Semgrep scans source with lightweight, writable pattern rules — fast, embeddable, and extensible enough to sketch policy-linting for migration files. RowShield evaluates the deployed catalog directly and probes behaviour, with rules maintained upstream. → /vs/vs-semgrep
- RowShield vs CodeQL / GitHub Advanced Security: CodeQL treats code as a queryable database of ASTs and dataflows — exceptional for vulnerability research in application code, bundled with GitHub Advanced Security. RowShield queries the actual Postgres catalog on a schedule. → /vs/vs-codeql
- RowShield vs Snyk: Snyk finds vulnerable dependencies, container and IaC misconfigurations from manifests. RowShield reads the deployed catalog itself — policies, exposure, drift — where manifest tools have no visibility. → /vs/vs-snyk
- RowShield vs Codacy: Codacy aggregates linters into hosted quality gates with dashboards, coverage trends and PR annotations. RowShield continuously evaluates Supabase catalog posture and probes anon-key behaviour. → /vs/vs-codacy
- RowShield vs DeepSource: DeepSource runs analyzers and transformers across commits — anti-patterns, coverage, formatting — as a hosted quality layer. RowShield monitors the deployed Supabase project itself. → /vs/vs-deepsource
- RowShield vs CodeRabbit: CodeRabbit applies large-language models to pull requests: summaries, incremental reviews, walkthroughs. RowShield verifies the resulting deployment continuously against the live catalog. → /vs/vs-coderabbit
- RowShield vs Greptile: Greptile indexes whole codebases so its AI reviewer understands cross-file context when critiquing PRs. RowShield reads no code at all — it interrogates the running database on schedule. → /vs/vs-greptile
- RowShield vs Graphite Diamond: Graphite Diamond is the AI reviewer inside Graphite’s stacked-pull-request platform, tuned for fast-moving merge trains. RowShield monitors Supabase deployments directly, independent of git workflow. → /vs/vs-graphite-diamond
- RowShield vs Qodo Merge: Qodo Merge (the hosted evolution of the open-source PR-Agent) automates PR descriptions, review questions and improvement suggestions with models. RowShield verifies the system those PRs produce, continuously. → /vs/vs-qodo-merge
- RowShield vs Cursor Bugbot: Cursor Bugbot extends the Cursor editor into PR review, flagging likely bugs in the code its users write. RowShield picks up where diffs end: auditing the live Supabase catalog those migrations produced. → /vs/vs-cursor-bugbot
- RowShield vs OWASP ZAP: ZAP is a free, open-source dynamic scanner maintained under the OWASP Foundation umbrella: an intercepting proxy plus spider, passive rules and active attacks you aim at a running application. RowShield is a continuous monitor built for Supabase: it reads catalog and policy state directly and re-verifies whenever your project changes. → /vs/vs-owasp-zap
- RowShield vs Burp Suite: Burp Suite is the professional toolkit for hands-on web application testing: an intercepting proxy with Repeater, Intruder, an embedded scanner in paid editions and an extension marketplace. RowShield is a continuous verifier for the layer beneath the HTTP: it evaluates Supabase policies and catalog state directly, automatically, on every change. → /vs/vs-burp-suite
- RowShield vs Invicti: Invicti, formed around the Netsparker business, sells mature enterprise DAST distinguished by proof-based scanning that confirms many findings with working evidence. RowShield answers a narrower question with more precision: it reads the Supabase catalog and policies directly and verifies them continuously as your project changes. → /vs/vs-invicti
- RowShield vs Acunetix: Acunetix, owned by Invicti and hence our careful phrasing Invicti (Acunetix), is a long-established web vulnerability scanner known for fast crawling and wide check coverage. RowShield examines the layer those crawls never open: it reads Supabase catalog and policy state directly and re-verifies on every change. → /vs/vs-acunetix
- RowShield vs Detectify: Detectify approaches security from outside the perimeter: it maps internet-facing assets and tests them with modules derived from crowdsourced researcher knowledge. RowShield works from the opposite direction, reading Supabase catalog and policy state inside the database to verify what the API actually permits. → /vs/vs-detectify
- RowShield vs Intruder: Intruder packages vulnerability scanning into an approachable managed service aimed at organisations without dedicated security staff, with clear reporting and sensible schedules. RowShield keeps the low-effort virtue but changes the subject: it verifies Supabase RLS posture, catalog state and drift semantically, at every change. → /vs/vs-intruder
- RowShield vs Probely: Probely is the closest philosophical cousin in this tier: a developer-oriented dynamic scanner with tidy automation, capable API testing and continuous modes. RowShield shares the temperament but not the method: it inspects Supabase catalog and policy definitions directly, resolving from source what black-box probing can only infer. → /vs/vs-probely
- RowShield vs Astra Security: Astra Security combines an automated vulnerability scanner with human penetration testing delivered through a shared dashboard, a bundle built for teams chasing attestation alongside findings. RowShield converts the authorisation half of that story into a permanent fixture: Supabase catalog and policy state verified continuously, not during engagement windows. → /vs/vs-astra-security
- RowShield vs Beagle Security: Beagle Security automates penetration testing on a recurring schedule and wraps findings in reports mapped to familiar control frameworks. Recurrence is closer to continuity than annual engagements manage, yet it still observes behaviour periodically. RowShield inspects Supabase policy state directly and reacts to every change as it happens. → /vs/vs-beagle-security
- RowShield vs Rapid7 InsightAppSec: InsightAppSec embeds web application scanning within the Rapid7 platform, appealing where application findings must sit beside wider exposure data and governance workflows. RowShield trades that breadth for depth at the Supabase data layer: catalog and policy semantics verified continuously, at engineering cadence and cost. → /vs/vs-rapid7-insightappsec
- RowShield vs Tenable WAS: Tenable WAS extends a leading exposure-management platform to web applications, giving security teams one correlated view of technical risk across the estate. Its view of a Supabase application remains external and scheduled. RowShield looks inside Postgres, where authorisation is decided, and verifies it with every change. → /vs/vs-tenable-was
- RowShield vs Cobalt: Cobalt helped define pentest-as-a-service: vetted freelance testers, streamlined scoping, collaborative reporting and retest options. Human adversarial skill of that kind retains real worth. RowShield supplies what engagements structurally cannot: continuous verification of Supabase authorisation posture between and beyond every test. → /vs/vs-cobalt-pentest
- RowShield vs HackerOne: HackerOne connects organisations with a vast researcher community through bug bounty programmes, vulnerability disclosure and managed pentests, yielding high-signal findings from genuine adversaries. RowShield addresses the deterministic layer beneath: Supabase catalog and policy state, verified exhaustively on every change so routine misconfiguration never reaches production unseen. → /vs/vs-hackerone-pentest
- RowShield vs Salt Security: Salt Security analyses mirrored API traffic with machine learning to build an endpoint inventory and spot anomalous behaviour across a large estate. RowShield reads the live Postgres policies behind your Supabase surface, probes PostgREST as an anonymous caller, and alerts when any of it changes. → /vs/vs-salt-security
- RowShield vs Akamai API Security: Akamai API Security, formerly Noname Security, discovers APIs out of band and models behaviour at portfolio scale inside Akamai’s application security suite. RowShield evaluates the Postgres policies that decide every Supabase request and probes PostgREST as the anonymous caller, with no sensors anywhere. → /vs/vs-akamai-api-security
- RowShield vs Wallarm: Wallarm grew from web application firewalling into an API security platform that inspects requests in-line and blocks matched threats before they reach your origin. RowShield evaluates the Postgres policies deciding what requests may touch, probes PostgREST as the anon caller, and reports the flaw itself rather than its exploitation. → /vs/vs-wallarm
- RowShield vs Traceable: Traceable builds API security on deep instrumentation: capture full transaction context across services, assemble inventories and data-flow maps, detect and block attacks from learned behaviour. RowShield needs no instrumentation at all; it reads Postgres policies directly, probes PostgREST anonymously, and reports findings with fixes attached. → /vs/vs-traceable
- RowShield vs 42Crunch: 42Crunch audits OpenAPI specifications, scores conformance between contracts and live traffic, and derives runtime protection from the spec. RowShield skips the description layer entirely and evaluates the Postgres policies that actually decide outcomes, probing PostgREST as an anonymous caller. → /vs/vs-42crunch
- RowShield vs Akto: Akto began as an open-source approach to API inventory and authorisation testing and has since steered its public direction heavily towards agentic-AI and MCP security. RowShield stays narrowly focused on Supabase: policies, endpoints, storage and auth settings, verified continuously from an attacker’s easiest entry point. → /vs/vs-akto
- RowShield vs Data Theorem: Data Theorem delivers application security testing as a service across mobile, web and API surfaces, combining automated analysis with managed review. RowShield confines itself to the Supabase layer, continuously evaluating Postgres policies and probing PostgREST exactly as an anonymous caller would. → /vs/vs-data-theorem
- RowShield vs Basejump: Basejump is an open-source Supabase starter providing personal accounts, team accounts, roles and invitations on carefully written RLS patterns, getting multi-tenancy right at birth. RowShield is the continuous monitor that verifies those policies, and everything your team changes afterwards, for the life of the product. → /vs/vs-basejump
- RowShield vs MakerKit: MakerKit sells production-shaped starter kits for SaaS products, with Supabase among supported backends: authentication flows, organisations, billing and admin screens arriving pre-assembled with considered RLS. RowShield verifies that those policies, and everything added afterwards, still hold in production, continuously. → /vs/vs-makerkit
- RowShield vs supastarter: supastarter produces SaaS starter kits across several frameworks, with Supabase support shipping tenancy, billing, localisation and considered RLS from the first commit. RowShield is the continuous monitor that verifies those policies survive everything your team writes afterwards, migrations included. → /vs/vs-supastarter
- RowShield vs Wiz: Wiz is an agentless cloud security platform that scans entire AWS, Azure and GCP estates and correlates exposures, identities and workloads into attack paths. RowShield is a continuous monitor built for one subject: the Supabase backend — its row level security, its REST surface, its storage rules, and how they change over time. → /vs/vs-wiz
- RowShield vs Orca Security: Orca Security is an agentless cloud security platform whose SideScanning technology reads workload state from snapshots, covering virtual machines, containers, identities and configurations across clouds from one data model. RowShield monitors one thing continuously: the Supabase backend — its policies, its anonymous-facing REST surface, and the drift between scans. → /vs/vs-orca-security
- RowShield vs Prisma Cloud: Prisma Cloud, from Palo Alto Networks, is a broad application-and-cloud security platform spanning code repositories, build pipelines, workload runtime and cloud posture. RowShield is a narrow continuous monitor for the Supabase backend: row level security, anonymous REST behaviour, storage exposure and drift, with remediation SQL attached to every finding. → /vs/vs-prisma-cloud
- RowShield vs Lacework (Fortinet): Lacework, now part of the Fortinet portfolio, is a cloud workload protection and posture platform known for behavioural anomaly detection across cloud workloads. RowShield is a continuous monitor for the Supabase backend alone: row level security posture, anonymous REST behaviour, storage exposure and policy drift between scans. → /vs/vs-lacework
- RowShield vs Sysdig: Sysdig brings deep runtime security to cloud workloads, built on the Falco open-source lineage: syscall-level visibility into containers and Kubernetes, joined to cloud posture management. RowShield monitors the Supabase backend continuously — row level security semantics, the anonymous REST surface, storage exposure and drift between scans. → /vs/vs-sysdig
- RowShield vs CrowdStrike Falcon Cloud Security: CrowdStrike Falcon Cloud Security extends the Falcon platform — famous for endpoint protection — into clouds: posture management, workload protection and identity-linked threat insights under one agent-and-console story. RowShield is a single-purpose monitor for the Supabase backend: row level security semantics, anonymous REST behaviour, storage exposure and drift. → /vs/vs-crowdstrike-cnapp
- RowShield vs Aqua Security: Aqua Security is a container and cloud-native protection specialist: image scanning, supply-chain assurance, Kubernetes controls and workload defence, extended with cloud posture. RowShield watches one subject continuously — the Supabase backend — covering row level security semantics, anonymous REST behaviour, storage exposure and policy drift. → /vs/vs-aqua-security
- RowShield vs Check Point CloudGuard: Check Point CloudGuard applies the company’s network-security heritage to clouds: posture management, network protection and unified policy across accounts and workloads. RowShield is a focused monitor for the Supabase backend — row level security semantics, anonymous REST behaviour, storage exposure and drift between scans. → /vs/vs-cloudguard
- RowShield vs Datadog Cloud Security: Datadog Cloud Security layers posture management — misconfigurations, identity risk, threat signals — onto the observability suite many teams already use for logs, traces and metrics. RowShield is a standalone continuous monitor for the Supabase backend: row level security semantics, anonymous REST behaviour, storage exposure and drift between scans. → /vs/vs-datadog-csm
- RowShield vs Tenable Cloud Security: Tenable, the vulnerability-management veteran behind Nessus, extended into cloud through identity-driven exposure analytics: Tenable Cloud Security maps who can reach what across large estates and ranks the paths that matter. RowShield monitors one subject continuously — the Supabase backend — covering row level security semantics, anonymous REST behaviour, storage exposure and drift. → /vs/vs-tenable-cloud
- RowShield vs Microsoft Defender for SQL: Microsoft Defender for SQL brings threat detection and vulnerability assessment to Azure SQL databases and SQL Server instances, surfacing anomalous queries and configuration weaknesses inside Azure estates. RowShield is a continuous monitor for Supabase backends: row level security semantics, anonymous REST behaviour, storage exposure and drift between scans. → /vs/vs-defender-for-sql
- RowShield vs AWS Security Hub: AWS Security Hub collects, normalises and scores security findings across an AWS organisation — its own checks plus partner products — against standards such as CIS. RowShield is a continuous monitor for Supabase backends: row level security semantics, anonymous REST behaviour, storage exposure and drift between scans. → /vs/vs-aws-security-hub
- RowShield vs Google Security Command Center: Google Security Command Center is the native posture and threat platform for GCP: asset inventory, misconfiguration detection, event threats and compliance reporting across the projects in an organisation. RowShield continuously monitors Supabase backends: row level security semantics, anonymous REST behaviour, storage exposure and drift between scans. → /vs/vs-google-scc
- RowShield vs IBM Guardium: IBM Guardium is an enterprise data-security platform that monitors whole fleets of managed databases through agents, gateways, and centralised consoles, aimed at regulated estates. RowShield is deliberately narrower: it verifies what each Supabase project exposes to an anonymous browser client, continuously. → /vs/vs-guardium
- RowShield vs Imperva Data Security Fabric: Imperva Data Security Fabric discovers, classifies, and monitors data stores across hybrid estates, with analytics tuned for insider and compromised-account risk alongside its well-known web application firewall business. RowShield answers the narrower question fabrics rarely reach: what can an anonymous caller read from each Supabase project right now? → /vs/vs-imperva-dsf
- RowShield vs Varonis: Varonis builds identity-centred data security: permission analytics, behavioural threat detection, and response automation across file systems, mail, and directories. RowShield answers a different question on a different platform: whether each Supabase project leaks data to anonymous callers through its public API. → /vs/vs-varonis
- RowShield vs BigID: BigID leads in discovering and classifying personal data across sprawling estates, powering catalogues, privacy rights workflows, and retention programmes. RowShield operates downstream of that knowledge: it verifies whether Supabase policies actually prevent unauthorised reads, project by project, on every schedule. → /vs/vs-bigid
- RowShield vs Sentra: Sentra represents the newer generation of agentless DSPM: connecting cloud accounts, discovering data stores automatically, classifying sensitive content, and prioritising risk across multi-cloud estates. RowShield trades that sweep for depth, verifying Supabase authorisation behaviour that inventory-led platforms do not evaluate. → /vs/vs-sentra
- RowShield vs Rubrik DSPM: Rubrik built its reputation on cyber resilience: backup, recovery orchestration, and ransomware readiness, extended into data security posture management along the way. RowShield addresses the prevention-side blind spot for Supabase: whether authorisation policies and key hygiene hold before anything ever needs restoring. → /vs/vs-rubrik-dspm
- RowShield vs Forcepoint DSPM: Forcepoint brings decades of data-loss-prevention heritage into a DSPM offering aimed at understanding data movement and risk across channels. RowShield narrows the lens to Supabase, empirically verifying the authorisation layer where hosted Postgres projects succeed or leak. → /vs/vs-forcepoint-dspm
- RowShield vs Securiti: Securiti builds governance automation: consent orchestration, privacy rights fulfilment, and data intelligence unified under compliance frameworks, with posture capabilities included. RowShield contributes the enforcement half for Supabase: proving, request by request, that policies and key hygiene actually protect data. → /vs/vs-securiti
- RowShield vs Trustwave DbProtect: DbProtect is a veteran database security product combining vulnerability assessment with activity monitoring for traditional DBMS estates, often delivered alongside managed services. RowShield brings equivalent vigilance to a platform it was never shaped for: managed Supabase Postgres exposed through a public REST API. → /vs/vs-trustwave-dbprotect
- RowShield vs GitGuardian: GitGuardian excels at detecting secrets across repositories, commit history, and developer workflows, with broad detector coverage, honeypot tokens, and enterprise rollout polish. RowShield defends the one credential class that defeats every row-level-security policy: a Supabase key served to browsers, wherever it currently lives. → /vs/vs-gitguardian
- RowShield vs TruffleHog: TruffleHog, whose team joined Wiz, popularised secret scanning with validity verification across a large detector library, combing repositories, histories, and pipelines. RowShield concentrates exclusively on Supabase keys served to browsers, the single credential class that renders row-level-security policies moot, and verifies deployed artifacts rather than code. → /vs/vs-trufflehog
- RowShield vs Gitleaks: Gitleaks is the dependable open-source workhorse of secret scanning: fast pattern-driven detection across repos, histories, and CI, configurable to taste and free forever. RowShield narrows to the decisive Supabase leak class, browser-served keys that bypass RLS, and verifies deployed bundles, a surface gitleaks by design never visits. → /vs/vs-gitleaks
- RowShield vs GitHub Secret Scanning: GitHub Secret Scanning embeds leak detection where code lives, with push protection stopping many accidents before they land and partner patterns covering exposed tokens at scale. RowShield complements the runtime half: verifying that nothing a browser downloads from your Supabase deployment carries a policy-bypassing key. → /vs/vs-github-secret-scanning
- RowShield vs GitLab Secret Detection: GitLab folds secret detection into its DevSecOps platform, scanning repositories through pipeline jobs and increasingly blocking risky pushes before merge. RowShield owns the subsequent blind spot: continuous verification that deployed Supabase artifacts serve no key capable of overriding row-level security. → /vs/vs-gitlab-secret-detection
- RowShield vs Better Stack: Better Stack polishes every facet of reliability communication: uptime checks, beautiful status pages, on-call scheduling, and log management. RowShield addresses the dimension reliability tooling structurally ignores: whether your Supabase project quietly permits strangers to read data while every green checkmark insists all is well. → /vs/vs-better-stack
- RowShield vs Checkly: Checkly is the strongest possible answer within its category: Playwright-powered synthetic monitoring that can script almost any request sequence across browsers and APIs. RowShield competes on knowledge rather than flexibility, encoding Supabase authorisation semantics so verification needs no bespoke scripting. → /vs/vs-checkly
- RowShield vs Cronitor: Cronitor masters scheduled-work accountability: heartbeats, uptime pings, and job telemetry that make silent failures loud within minutes. RowShield monitors a different silence entirely: permissive Supabase policies leaking data nightly while every job pings home successfully. → /vs/vs-cronitor
- RowShield vs Healthchecks.io: Healthchecks.io distils monitoring to its essence: dead-man-switch pings that scream when expected signals go quiet, self-hostable and refreshingly honest about scope. RowShield monitors the opposite pathology: signals arriving punctually while permissions rot, giving Supabase projects a sentinel heartbeats cannot imitate. → /vs/vs-healthchecks
- RowShield vs Atlantis: Atlantis is open-source pull-request automation for Terraform: comment-driven plans, locked applies, review-native workflow. Its state view stops at resources HCL declares, so row-level security changes made outside git are invisible to it. RowShield watches that lower layer continuously. → /vs/vs-atlantis
- RowShield vs Spacelift: Spacelift is a capable commercial control plane for infrastructure delivery: managed runners, OPA policy guardrails, drift detection measured against Terraform state. Database posture inside Supabase lives mostly outside that state, so RowShield covers what Spacelift structurally cannot see. → /vs/vs-spacelift
- RowShield vs env0: env0 organises infrastructure delivery into governed environments with remote state, approval flows and drift detection against managed state. Supabase row-level security usually escapes declaration, which leaves the layer RowShield patrols uncovered by env0 by design. → /vs/vs-env0
- RowShield vs Firefly: Firefly excels at discovering shadow cloud resources and herding them back into code, with drift insights across providers and accounts. Its unit of account is the cloud resource; the Postgres catalog inside a Supabase project sits a level deeper, and that is where RowShield works. → /vs/vs-firefly
- RowShield vs ControlMonkey: ControlMonkey brings import-and-codify flows, governed planning and automated drift remediation to large Terraform estates, opening corrective pull requests when reality wanders from state. Supabase row-level security usually escapes declaration, leaving the catalog to RowShield. → /vs/vs-controlmonkey
- RowShield vs pganalyze: pganalyze is excellent at why queries are slow: plan capture, regression alerts and index advice few tools match. It does not evaluate exposure. RowShield occupies that adjacent layer, overlapping only where slow policies reveal unsafe ones. → /vs/vs-pganalyze
- RowShield vs pgMustard: pgMustard offers superb opinionated review of individual query plans: where time went, which estimates misled, what to try. It is a scalpel for latency, not a lens for exposure. RowShield covers posture, plus the seams where policy design appears as cost. → /vs/vs-pgmustard
- RowShield vs PgHero: PgHero is a pleasant open-source dashboard for Postgres vital signs: slow queries, unused indexes, connection pressure. It observes behaviour. RowShield evaluates structure — the policies and grants where exposure hides — and watches it on a schedule. → /vs/vs-pghero
- RowShield vs A manual security audit: A manual audit puts experienced people against your system for a defined period and returns judgement-rich findings. Software cannot imitate that. What an engagement cannot contribute is coverage of the weeks after the report lands — the interval RowShield exists to hold. → /vs/vs-manual-security-audit
- RowShield vs A homegrown script: A homegrown posture checker is genuinely feasible, and building one teaches the catalog better than any article. The honest accounting: days to build, hours per month forever, with failure modes that are silent by nature. RowShield exists for teams preferring to spend that attention on their product. → /vs/vs-build-your-own-monitor
- RowShield vs Doing nothing: Doing nothing is the default configuration of attention: no scanner, no scheduled review, posture checked only when memory prompts. It trades a small certain saving for a small uncertain risk — reasonable for throwaway prototypes, costly accident for anything holding real user data. → /vs/vs-do-nothing
- RowShield vs Community forums: Community forums and chat channels excel at unblocking one person with one error today, usually within hours. Continuous posture is a different species of problem: no questioner, no thread, no urgency until late. Monitoring fills the space forums structurally cannot reach. → /vs/vs-supabase-support-forums

## API
- Public probe: POST /api/v1/probe/public
- Connect a project: POST /api/v1/projects/connect
- Force a scan: POST /api/v1/projects/:id/scan-now
- Findings: GET /api/v1/projects/:id/findings
- Live scan status (SSE): GET /api/v1/projects/:id/stream

## Optional
- Full agent context: /llms-full.txt
- Free audit: /audit
- Rules index: /docs/rules
- Writing: /blog
- About, and the parent company: /about · https://veristria.com