audit-supabase-rls

To audit Supabase Row Level Security policies, you can analyze SQL migrations and client configurations to identify missing ENABLE ROW LEVEL SECURITY statements and verify proper owner-based access checks using auth.uid(). This process flags insecure SECURITY DEFINER usage and risky client patterns that bypass RLS.

AI code generators commonly miss enabling Row Level Security on new tables, write policies lacking auth.uid() owner-based access checks, and use SECURITY DEFINER functions without internal authorization checks. These gaps expose sensitive user data by allowing unrestricted access to database records.

SECURITY DEFINER functions execute with the privileges of the function owner, bypassing Supabase RLS policies entirely. Auditing detects these functions when they lack internal authorization checks, ensuring they do not expose sensitive user data by inadvertently circumventing Row Level Security restrictions.

You can check your Supabase client configuration by auditing app code to identify risky client usage that bypasses RLS or exposes sensitive data. This involves reviewing how client queries are constructed to ensure they respect Row Level Security policies and do not use elevated privileges.

Yes, you can audit SQL migrations to ensure proper RLS coverage by checking each migration file for ENABLE ROW LEVEL SECURITY statements and verifying that policies include auth.uid() for owner-based access. This ensures comprehensive Row Level Security coverage across your database schema.

You need to run a Row Level Security audit when integrating AI-generated SQL migrations or client code into your Supabase project. Auditing is essential after adding new tables, functions, or policies to ensure RLS coverage is maintained and no security gaps are introduced.