Guide

Is Supabase secure? Check RLS, the service role key and public storage

Short answer

A Supabase security check verifies that Row Level Security is enabled and correct on every table, that the service-role key never reaches the browser, and that storage buckets are not public by mistake. Hackaiz replays anonymous requests to prove what is really exposed, then proposes the policy fix.

By the Hackaiz team · HACKTUALIZ Inc. · Updated 2026-10-21

Start my first scan

The most common Supabase mistakes

RLS disabled on a table, so anyone with the public key can read it.
Policies that allow every logged-in user to read other users’ rows.
Service-role key committed or shipped in front-end code.
Roles stored on the profile table, letting users promote themselves.
Public storage buckets holding private files.

How Hackaiz checks it

From the code, Hackaiz reviews SQL migrations and policies. Against the live project, it sends read-only anonymous requests and records the exact response as proof — a 401 means protected, rows returned means exposed. With your approval, a read-only database connection lets it audit roles, tables and operations in a matrix.

No destructive tests

Hackaiz never writes, deletes or modifies data. Live database checks require owner approval and run in a read-only session.