RowShield vs Detectify: outside-in surface vs inside-out RLS

Head to head: Detectify vs RowShield

Column claims about Detectify are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.

What Detectify does

Detectify AB, a Swedish security company, builds attack-surface management products that map the internet-facing footprint an organisation presents and continuously assess it. Its scanner applies test modules derived from crowdsourced vulnerability research contributed by a community of security specialists, so newly public techniques tend to reach the platform quickly.

Customers hand over domain names and receive an inventory of discovered subdomains, hosts and services along with findings from probing them. The value proposition centres on the unknown: assets somebody stood up and forgot, exposures nobody inventoried, running software nobody remembers choosing. That is a real and useful fear to retire.

Where the scopes differ

An outside-in vantage point shapes everything Detectify can conclude. Supabase endpoints respond politely to unauthenticated callers by design, serving JSON whose meaning depends wholly on Postgres policy evaluation invisible from outside. A table readable by the anon role and a table protected by a precise policy can return near-identical responses; a policy filtering all rows and an empty table are twins.

External testing therefore cannot grade the thing that matters, whether authorisation is configured correctly, and cannot observe the moment a migration changes it. Interior truths demand interior instrumentation, which means reading the catalog the way RowShield does rather than inferring from responses.

On the three-capability lens, surface tools hold discovery breadth but none of posture, behaviour semantics, or drift; those live where the policies live.

Why Supabase teams choose RowShield over Detectify

Attack-surface discovery and authorisation verification solve different anxieties. Once you know which assets exist, someone still must confirm that the database behind your primary application refuses to leak. RowShield answers that continuously: rules such as ANON_TABLE_READABLE, RLS_DISABLED and SERVICE_ROLE_KEY_EXPOSED evaluated on every merge, drift expressed against known-good posture, alerts routed to the engineers who can act.

Nothing depends on a scan schedule coinciding with a mistake. For teams whose risk concentrates in one Supabase backend, a specialist monitor delivers relevance, immediacy and price proportionate to that focus, where a surface-management platform spreads attention across everything at once.

Where Detectify is the right choice

Organisations with sprawling domains, marketing sites, staging systems and legacy services gain genuine value from automated discovery of what is publicly reachable, and the research-driven modules give external testing respectable depth. If shadow infrastructure keeps you awake, that category of tool addresses the fear directly.

The concession is depth at the data layer: surface maps stop at the front door and cannot testify about policy correctness inside Postgres, nor notice internal drift between assessments. Buy the outside-in view for inventory and unknown-host hunting; obtain the inside-out truth about RLS from a purpose-built source.

Using both

They slot together naturally because their vantage points differ. Detectify keeps answering what is exposed to the internet and whether known techniques apply, refreshing its inventory as your footprint grows. RowShield answers whether the Supabase data layer behaves as intended, continuously and semantically.

When Detectify discovers a host you did not expect, connecting its backing project to RowShield gives immediate insight into whether that instance protects its data properly. When RowShield confirms posture is sound, external probes returning nothing alarming stops being luck and becomes expectation. Outside-in discovery plus inside-out verification covers both halves of the exposure question.

Frequently asked

Is RowShield affiliated with Detectify AB?

No. RowShield is developed independently by Veristria and has no affiliation with, endorsement from or sponsorship by Detectify AB. The Detectify name and marks belong to Detectify AB and appear here solely for comparison.

Does RowShield replace attack surface monitoring, or complement it?

It complements it deliberately. Attack-surface tools discover and probe what faces the internet; RowShield verifies how the Supabase data layer authorises access from within. Teams wanting both perspectives run Detectify for discovery and breadth, and RowShield for continuous, semantic RLS and drift assurance on their databases.

Could Detectify flag an anon-readable Supabase table?

Only incidentally. Externally, an anon-readable table and a correctly protected one can behave identically, since PostgREST returns normal responses either way, and policy-filtered emptiness mimics empty data. Without catalog access there is no reliable way to grade authorisation from outside. RowShield reads policy and grant state directly and raises the finding with the object named.