RowShield Secure Promises: Exact Coverage Limits

RowShield does not promise a secure database — the nine rules are the entire ceiling of what it claims, stated plainly on the site.

Continuous RLS testing, schema-drift detection and security monitoring

Continuous RLS testing, schema-drift detection and security monitoring for Supabase backends.

RowShield runs security checks on AI-built Supabase apps

RowShield runs security checks on AI-built Supabase apps: RLS policies, leaked keys, public storage and schema drift, before they become incidents.

AI writes the schema and nobody writes (service_role)

AI writes the schema and nobody writes the policies.

• High-velocity Supabase backends ship with dangerous defaults: RLS disabled on a table that PostgREST will happily serve to anyone holding the anon key, which is public by design and ships in the client bundle.
• Permissive policies whose expression is a constant true, so the dashboard reports the table as protected while it is wide open.
• A service_role key in a client bundle, which bypasses RLS entirely and makes every policy in the project decorative.
• And publicly accessible storage buckets.

The audit is free

The audit is free.

• Continuous monitoring is Indie at $29 per month (up to 3 projects, hourly scans, email and Slack alerts, 1 seat) or Team at $99 per month (up to 15 projects, 15-minute scans, email, Slack, Discord and custom webhooks, unlimited seats), with Growth from $279 per month.
• Annual billing is priced at ten times the monthly rate.

Nine detection rules across the catalog (RLS_DISABLED, RLS_TAUTOLOGY)

Nine detection rules across the catalog and the public surface, with named rules a reader can look up: RLS_DISABLED, RLS_TAUTOLOGY, SERVICE_ROLE_KEY_EXPOSED, PUBLIC_BUCKET_EXPOSURE — the full nine-rule audit runs once a project is connected.

Each finding ships with the remediation SQL, generated

Each finding ships with the remediation SQL, generated from the project’s actual columns rather than from a template.

A free read-only audit at rowshield.dev (service_role, rowshield.dev)

A free read-only audit at rowshield.dev.

• Paste a deployed app URL — no account, no signup, no database writes.
• RowShield reads the public bundle to discover the Supabase connection.
• An anon key is not required, since it is auto-discovered from the page and its bundles, and a pasted service_role key is refused outright.
• GET, HEAD and OPTIONS only.
• Nothing is stored beyond a column count and a key fingerprint.
• Typically finishes in under ten seconds, capped at 50 tables and 25 seconds.