audit-supabase-rls

Name: audit-supabase-rls
Availability: InStock
Author: Shan

Audit Supabase Row Level Security policies in SQL migrations and client configuration.

1|Updated May 2, 2026

Search Tags:#rls #supabase #auth.uid #row-level-security #database-security #ai-code-generation #sql-audit

Ready to run

npx skills add https://github.com/Shankulkarni/vibe-audit --skill audit-supabase-rls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: audit-supabase-rls
Source: https://github.com/Shankulkarni/vibe-audit/tree/main/skills/audit-supabase-rls
Command: npx skills add https://github.com/Shankulkarni/vibe-audit --skill audit-supabase-rls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Audit Supabase Row Level Security policies for gaps AI code generators commonly miss.

Core Features & Use Cases

Analyzes SQL migrations and client configuration to ensure proper RLS coverage and owner-based access checks.
Flags missing ENABLE ROW LEVEL SECURITY and any SECURITY DEFINER usages without internal authorization checks.
Highlights risky client configurations that bypass RLS or expose sensitive data.

Quick Start

Explain how to audit Supabase RLS configurations in your codebase and fix gaps in policies and client usage.

Frequently Asked Questions about audit-supabase-rls

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Supabase Row Level Security policies for gaps in AI-generated code?▼

To audit Supabase Row Level Security policies, you can analyze SQL migrations and client configurations to identify missing ENABLE ROW LEVEL SECURITY statements and verify proper owner-based access checks using auth.uid(). This process flags insecure SECURITY DEFINER usage and risky client patterns that bypass RLS.

What common Supabase RLS gaps do AI code generators introduce?▼

AI code generators commonly miss enabling Row Level Security on new tables, write policies lacking auth.uid() owner-based access checks, and use SECURITY DEFINER functions without internal authorization checks. These gaps expose sensitive user data by allowing unrestricted access to database records.

How does SECURITY DEFINER affect Supabase RLS policy enforcement?▼

SECURITY DEFINER functions execute with the privileges of the function owner, bypassing Supabase RLS policies entirely. Auditing detects these functions when they lack internal authorization checks, ensuring they do not expose sensitive user data by inadvertently circumventing Row Level Security restrictions.

How do I check if my Supabase client configuration bypasses Row Level Security?▼

You can check your Supabase client configuration by auditing app code to identify risky client usage that bypasses RLS or exposes sensitive data. This involves reviewing how client queries are constructed to ensure they respect Row Level Security policies and do not use elevated privileges.

Can I audit SQL migrations to ensure proper RLS coverage for Supabase user data?▼

Yes, you can audit SQL migrations to ensure proper RLS coverage by checking each migration file for ENABLE ROW LEVEL SECURITY statements and verifying that policies include auth.uid() for owner-based access. This ensures comprehensive Row Level Security coverage across your database schema.

When do I need to run a Row Level Security audit on my Supabase project?▼

You need to run a Row Level Security audit when integrating AI-generated SQL migrations or client code into your Supabase project. Auditing is essential after adding new tables, functions, or policies to ensure RLS coverage is maintained and no security gaps are introduced.