RowShield vs Acunetix: web scanning vs database policy truth

Head to head: Acunetix vs RowShield

Column claims about Acunetix are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.

What Acunetix does

Acunetix, owned by Invicti Security Corp., hence our careful phrasing Invicti (Acunetix), is a dynamic web vulnerability scanner with roots stretching back over a decade. It crawls applications and APIs at speed, runs an extensive library of checks covering injection flaws, misconfigurations and component weaknesses, and integrates with issue trackers and CI pipelines.

Enterprise editions add orchestration across many targets. Its reputation rests on thorough crawling and dependable coverage of well-known vulnerability classes, making it a common selection for teams that need repeatable external testing of web properties on a schedule.

Where the scopes differ

Supabase applications expose a PostgREST facade whose safety depends entirely on Postgres internals. Acunetix observes the facade; RowShield reads the interior. When row level security filters results, the API returns ordinary empty payloads that carry no hint of suppression, so a scanner cannot distinguish a locked-down table from an unprotected one returning nothing.

It likewise cannot notice that a migration disabled protection, that a grant now includes the anon role, or that a service-role key travelled into client-side code. These conditions generate no anomalous HTTP signature during any scan window, and between windows nothing is watching at all.

The three-capability lens makes the split plain: configuration posture, anon-caller behaviour and drift-over-time are all held by the catalog side of the divide, not by the crawler.

Why Supabase teams choose RowShield over Acunetix

The decision reduces to matching tool to question. If the question is whether your Supabase authorisation posture is correct right now, and whether yesterday migration changed it, RowShield answers directly: rules such as RLS_DISABLED, ANON_TABLE_READABLE and SERVICE_ROLE_KEY_EXPOSED are evaluated against live catalog state and re-evaluated on every merge.

Findings arrive named and located, understandable by whoever wrote the migration, minutes after it lands. There is no scan schedule to await, no output to interpret, and no enterprise budget conversation to endure.

Specificity, latency-to-alert and cost are the three axes on which a purpose-built monitor outperforms a general scanner for this purpose, and on all three the difference is structural rather than marginal.

Where Acunetix is the right choice

Teams responsible for conventional multi-page or SPA applications beyond Supabase benefit from the broad check library, and compliance contexts that expect documented periodic scanning are well served. It will find issues, such as reflected injection points or outdated server behaviours, that no database-aware monitor considers.

The honest concession is that breadth brings blindness at the data layer and a cadence mismatch with engineering work. Periodic external sweeps verify the past; they do not guard the migration you merged this morning. Use it for what it sees; do not ask it to hold the authorisation line.

Using both

A practical division of labour keeps each tool where it excels. RowShield runs continuously against your Supabase project, verifying posture on every merge and alerting on drift, so configuration regressions never survive longer than a working session.

Acunetix then provides scheduled breadth across your broader web estate, catching vulnerability classes outside the data layer. When its report touches API endpoints, cross-reference against RowShield catalog findings to understand whether authorisation semantics explain the observation. The result is layered assurance: generalist scanning for the perimeter, specialist always-on verification for the database where your customer data lives.

Frequently asked

Who owns Acunetix and is RowShield affiliated with them?

Acunetix is owned by Invicti Security Corp., which is why we refer to the product as Invicti (Acunetix) where clarity matters. RowShield, built by Veristria, is independent and unaffiliated; all trademarks belong to their respective owners.

Should we drop Acunetix for RowShield or combine them?

Combine them if you maintain non-Supabase web assets, since the broad check library remains useful there. RowShield is the better instrument for the Supabase data layer specifically: continuous rather than scheduled, semantic rather than behavioural. Many teams let general scanning cover the estate and rely on RowShield for the database.

How quickly does RowShield catch a regression compared with a scanner?

RowShield evaluates posture whenever migrations or configuration change, so a regression introduced at merge time is flagged within minutes, naming the rule and object involved. A scheduled scanner notices only at its next window, if the behavioural signature is recognisable at all, which for silent policy changes it usually is not.