Comparisons / Web-app scanners & pentest
RowShield vs Intruder: infrastructure scanning vs the Supabase data layer
The short version
- Intruder packages vulnerability scanning into an approachable managed service aimed at organisations without dedicated security staff, with clear reporting and sensible schedules. RowShield keeps the low-effort virtue but changes the subject: it verifies Supabase RLS posture, catalog state and drift semantically, at every change.
- Choose Intruder when — you want broad, managed vulnerability management across clouds, networks and web properties, with reporting that satisfies certification housekeeping.
- Choose RowShield when — your dominant risk is one Postgres-backed application, and you want its authorisation layer checked mechanically at merge time with findings phrased for developers.
RowShield rules relevant here
- criticalTable readable with the anon key
- criticalRow Level Security disabled
Head to head: Intruder vs RowShield
| Capability | Intruder | RowShield | Edge |
|---|---|---|---|
| Primary target | Infrastructure and services scanned for known vulnerabilities. | Supabase data layer: RLS, policies, grants, roles and API behaviour. | RowShield |
| Checking basis | Signature and configuration checks against discovered systems. | Semantic evaluation of catalog and policy definitions. | RowShield |
| PostgREST awareness | Endpoints handled as generic web targets. | Native understanding of role scoping, RPC and embedded resources. | RowShield |
| Filtered versus empty results | No basis to distinguish suppression from absence. | Meaning resolved from policy state, definitively. | RowShield |
| Trigger model | Scheduled sweeps across defined targets. | Event-driven: every migration and configuration change verified. | RowShield |
| Audience of findings | Risk-rated vulnerability lists oriented to security owners. | Engineers receive named rules and objects, actionable immediately. | RowShield |
| Managed simplicity | Strong: cloud-hosted scanning with little setup burden. | Lightweight connection to the project; minimal administration. | Intruder |
Column claims about Intruder are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What Intruder does
Intruder, a UK company, offers cloud-based vulnerability scanning aimed at organisations that lack a dedicated security engineering function. Targets, external infrastructure, internal networks and web applications, are registered once, and the platform runs industry-standard scanning engines against them on schedules or on demand, consolidating results into a prioritised console.
Reporting leans towards reassuring clarity for non-specialists and maps reasonably onto compliance conversations, which has made it popular with startups preparing certifications. The pitch is competence without headcount: professional-grade checking delivered as a managed service, and for general vulnerability management it delivers precisely that.
Where the scopes differ
Vulnerability management asks whether known weaknesses exist on reachable systems. Authorisation posture asks whether your database currently permits what it should refuse, a question answered only by examining Postgres itself. Scanning a Supabase endpoint observes HTTP behaviour shaped by policies the scanner cannot see.
Filtered results masquerade as empty data, disabled protection leaves no signature, and a service-role key bundled into client code is invisible to network-facing checks. Even perfectly executed sweeps therefore leave the central risk unmeasured, and the schedule introduces blind intervals during which a careless migration can quietly widen access.
Of the three capabilities RowShield holds, configuration posture, anon-caller semantics and drift-over-time, a signature-led sweep addresses none of them for a PostgREST backend.
Why Supabase teams choose RowShield over Intruder
Startups adopt Intruder because it removes operational burden; RowShield keeps that virtue while aiming at the layer where Supabase risk concentrates. Verification is event-driven, so every pull request that touches schema or policy triggers fresh evaluation of rules including RLS_DISABLED, ANON_TABLE_READABLE and SERVICE_ROLE_KEY_EXPOSED.
Results speak developer language: the rule violated, the table concerned, the definition at fault. Latency-to-alert is measured in minutes from merge rather than days until the next sweep, and because the product does one job, pricing stays proportionate to a small team.
For the actual daily question about data safety, specificity and immediacy decide the argument.
Where Intruder is the right choice
For organisations needing broad vulnerability management across clouds, networks and assorted web properties with minimal staffing, Intruder is a reasonable and honest choice, particularly where certification audits expect documented recurring scanning. It will catalogue weaknesses RowShield never looks for, on systems RowShield never touches.
The concession is categorical: scheduled, signature-led scanning cannot certify authorisation semantics on a PostgREST backend, nor react to repository events. Treat it as the generalist ledger of technical debt elsewhere in the estate, while accepting that your database needs a different kind of witness.
Using both
The pairing works because neither pretends to cover the other. Intruder continues its scheduled sweeps over infrastructure and peripheral services, feeding certification evidence and keeping generic debt visible. RowShield attaches to the development rhythm, verifying Supabase posture at every merge and converting drift into immediate, named alerts.
Findings from either side inform the other: a scanner observation about the API prompts a catalog check, while a posture alert prompts confirmation that no other exposure accompanies it. Together they form sensible coverage: managed breadth for the estate, specialist continuity for the data layer.
Frequently asked
- Is RowShield affiliated with Intruder?
- No. RowShield is built by Veristria and operates independently of Intruder Systems Ltd., trading as Intruder. References to the product are comparative only, and all trademarks remain the property of their respective owners.
- Would RowShield replace Intruder or run alongside it?
- Alongside, in most setups. Intruder handles vulnerability management across infrastructure and miscellaneous web targets; RowShield owns continuous authorisation verification for Supabase. If Supabase posture is your dominant concern and general scanning adds little today, RowShield alone covers the highest-stakes layer at lower effort.
- Does scheduled scanning satisfy the need for RLS verification?
- No. Scans sample behaviour at points in time and cannot infer policy correctness from responses, since filtered and empty results look alike. Between sweeps, migrations go unwatched. RowShield evaluates catalog and policy state on every change, closing the interval during which silent regressions would otherwise persist undetected.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit