Comparisons / Platform-native
RowShield vs Supabase Storage defaults: templates vs audited outcomes
The short version
- Supabase Storage ships template policies and sensible defaults so buckets work within minutes of creation. RowShield treats whatever is configured — templates included — as a hypothesis to verify: bucket visibility, anon reachability and drift are checked on every scan.
- Choose Supabase Storage default policies when — you are setting up storage for the first time and want the documented starting point without adding tooling.
- Choose RowShield when — buckets were configured from templates months ago, the product has changed shape since, and nobody has re-tested what the anon caller can actually fetch today.
RowShield rules relevant here
Head to head: Supabase Storage default policies vs RowShield
| Capability | Supabase Storage default policies | RowShield | Edge |
|---|---|---|---|
| Purpose | Authoring convenience: copy a template, adjust it to your paths, ship. | Outcome auditing: test what the configured rules actually permit, on every scan, indefinitely. | RowShield |
| Public-bucket detection | Visibility is whatever was set at creation time; no standing audit of the setting. | PUBLIC_BUCKET_EXPOSURE evaluates bucket configuration on every scan and alerts on flips. | RowShield |
| Live anon fetch test | Templates describe intent; nothing exercises the result as a real caller. | The probe issues GET requests as the anon caller and records what each table and surface returns. | RowShield |
| Drift after edits | A flipped bucket or edited template policy produces no signal by itself. | Snapshot diffs classify the change and alert on the transition — created, resolved or regressed. | RowShield |
| Speed to first bucket | Minutes, inside the dashboard, with zero new accounts or credentials. | Not applicable — RowShield writes nothing to your project and creates nothing. | Supabase Storage default policies |
| Vendor authority | Written by the platform team and kept current with Storage releases. | Independent: reads metadata only, changes nothing, and is unaffiliated with Supabase. | Supabase Storage default policies |
Column claims about Supabase Storage default policies are sourced below. Where the edge is theirs, the page says so — and the sections that follow explain why Supabase teams still pick RowShield.
What the Storage default policies do
Supabase Storage organises files into buckets, and access to them is governed by policies evaluated per request. The dashboard and documentation ship template policies for common shapes — public read, authenticated read and write, per-user folder paths — so a working upload flow exists within minutes of creating a project.
They are a considered starting point by the platform team, and nothing on this page should be read as advice against them. They are, however, an authoring tool: they encode intent at the moment of copying, and they have no opinion about what the configuration permits six months later.
Where the scopes differ
The gap between authoring and assurance is where storage incidents live. Templates encode intent at copy time; products drift afterwards. Folders get renamed so a per-user prefix no longer matches, a path pattern widens to make one feature work, a bucket flips to public for a single launch and stays public. Nothing in the template reminds anyone, because an authoring tool produces configuration, not evidence.
Mapped onto RowShield's three lenses: posture is only partially held — whatever was configured is knowable, but nothing grades it against intent; behaviour is not held at all, because no template ever issues a request; and time is not held, because there is no record between the day you copied the template and the day something went wrong.
RowShield holds the other side of each line. PUBLIC_BUCKET_EXPOSURE evaluates bucket configuration on every scan. The probe issues GET requests as the anon caller and records what actually comes back, because a policy that reads correctly can still filter differently than its author assumed. And catalog snapshots are diffed scan to scan, so the quiet flip to public is reported as a transition with an alert attached.
Why Supabase teams choose RowShield over the default templates
If storage holds user uploads, the operative question is not "did we pick a sensible template?" but "what can an anonymous caller fetch today?" RowShield answers that question on every scan with rule-backed checks — PUBLIC_BUCKET_EXPOSURE for the bucket setting, ANON_TABLE_READABLE for the tables behind your storage metadata, SERVICE_ROLE_KEY_EXPOSED for the key class that overrides storage policies when it leaks into a deployed bundle.
Findings arrive as transition alerts to Slack, Discord, email or webhooks, with remediation SQL generated from your actual configuration. A template chosen deliberately in January and verified continuously in July is a defensible posture; a template chosen in January alone is an assumption with a date on it.
Where the Storage defaults are the right choice
For a new project, a first bucket, or a team still learning the storage model, the templates are the correct move: read the platform's own guidance, start from its defaults, and adjust deliberately. For assets with genuinely public intent — marketing files, documentation, product imagery — the default posture may simply be correct, and paying to audit a bucket that is public on purpose is ceremony. RowShield earns its place when storage holds anything whose exposure would matter.
Using both
Keep the templates as the authoring layer and add verification as the audit layer; they do not compete. The template decides what the rules say; the scan and the probe establish what the rules do. When the two disagree — a template scoped to a folder prefix, a probe returning rows outside it — the discrepancy is the finding, and it is exactly the kind that never surfaces from the dashboard alone.
Frequently asked
- Is RowShield affiliated with Supabase?
- No. RowShield is built by Veristria, an independent company, and is unaffiliated with Supabase, Inc. Supabase Storage is referenced descriptively and remains a trademark of its owner.
- Is RowShield a good alternative to relying on the storage templates?
- They are complementary rather than competing: the templates are how you author access, RowShield is how you verify what the result permits over time. Teams usually keep both.
- How do I check whether a Supabase storage bucket is public?
- The dashboard shows the visibility setting per bucket. RowShield reports it on every scan under the PUBLIC_BUCKET_EXPOSURE rule and alerts if a private bucket is ever flipped to public.
Check your project in about ten seconds
Paste a URL. No signup, no writes, nothing stored.
Run the free audit