Free ways to audit a Supabase project, honestly compared
Auditing a Supabase project for the classic failure modes costs nothing if you know the routes. The platform ships a built-in advisor; the catalog answers structured questions to anyone with psql; a deployed app can be probed with nothing but its public URL; and RowShield's own free audit and Free tier need only a project URL to start.
This page walks the four options in order of setup effort, states plainly what each yields and what it cannot see, and closes with a sensible way to combine them. No option here hides its limits — a free audit that overstates itself is worse than none.
RowShield does not detect this yet. This guide gives you the catalog queries to check it yourself. The nine rules that do ship are listed on the rules index.
The four options
First, the dashboard Security Advisor. It ships with Supabase, reviews configuration without any setup, and flags conditions such as public-schema tables without row-level security. As a first stop it is the right one — open it before anything else on this page.
Second, hand-run catalog queries. With any read-capable role, pg_class and pg_policies answer the structural questions directly: which tables lack row-level security or fail to force it, and which policies reduce to constant truths or omit WITH CHECK. Cost is one afternoon of learning; the queries are yours forever afterwards.
Third, self-made probing. A GET against /rest/v1/<table> with your public anon key shows what an unauthenticated caller receives — rows, an ambiguous empty array, or a policy error. Fourth, RowShield: the free audit at rowshield.dev/audit takes a project URL and runs the catalog rules and probe for you, no account required.
What each route yields — and misses
The advisor is fast and native but reports state at the moment you open it; migrations landing tomorrow are invisible until someone reopens the page. Hand-run queries go deeper than any dashboard and teach the schema, but they are photographs — nobody diffs last month's output against this month's by hand for long.
Self-made probing exercises behaviour rather than configuration, which is where surprises live, yet it sees only the public surface and returns an empty array for both denied-and-empty and genuinely-empty — ambiguity you must remember to respect. Automated audits compress all of it, but a third party is now reading metadata on your behalf, which deserves scrutiny of its claims.
On that scrutiny, stated concretely: RowShield's scanner reads pg_catalog and storage bucket metadata only, never your table rows; its probe issues GET, HEAD and OPTIONS requests only, refusing private network ranges before connecting; and the introspection statements are exported for inspection by anyone who wants to verify the claims.
Combining them without overcomplicating
A sensible sequence follows from the costs. Open the advisor today; run the free RowShield audit once against your project URL and read the findings with their reproducible queries; fix what appears, starting with any exposed privileged key, since rotation outranks analysis by a wide margin.
Then decide about continuity. The Free plan keeps one project watched with daily scans and email alerts, and findings are never withheld on any tier — plans change frequency and roster, never truth. Paid tiers add pace and destinations: hourly scans and Slack delivery on Indie for three projects; fifteen-minute scans, Discord embeds and custom webhooks on Team for fifteen projects with unlimited seats; Growth above that, quoted individually. Rates are on the pricing page, with annual billing at ten times the monthly price.
One caution worth keeping
Whichever mix you choose, keep the claims attached to evidence: a query next to every finding, dated outputs in a findable place, and a clear line between what a tool checked and what it merely did not mention. Silence is not coverage on any platform.
The same honesty applies in the other direction — a clean result from any free route is true of one moment within one scope. RowShield is an independent product, unaffiliated with and not endorsed by Supabase. The free audit lives at rowshield.dev/audit — paste a URL, read the findings.
Frequently asked
- Is RowShield's audit really free?
- Yes — the audit at rowshield.dev/audit needs only a project URL and no account, and the Free tier afterwards keeps one project on daily scans with email alerts. Findings and remediation SQL are never withheld on any tier.
- Why not rely only on the built-in advisor?
- You should absolutely open it — it is a good, free, native check. Its model is a snapshot, so the honest addition is something watching the interval between visits, when migrations land and earlier fixes regress.
- What does a free audit not cover?
- No free route here reviews source code, dependencies, headers or TLS — the scope is database posture: policies, flags, buckets, key exposure and the deployed API's behaviour toward unauthenticated callers. Anything beyond that scope needs different tooling.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit