supabase-rls-audit

Audit Supabase RLS policies across public schema tables and generate remediation SQL.

Updated Jan 26, 2026

Search Tags:#security #database #rls #audit #supabase #policy

Ready to run

npx skills add https://github.com/anhnq-lab/cic-erp-contract --skill supabase-rls-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: supabase-rls-audit
Source: https://github.com/anhnq-lab/cic-erp-contract/tree/main/.agent/skills/supabase-rls-audit
Command: npx skills add https://github.com/anhnq-lab/cic-erp-contract --skill supabase-rls-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and fix security vulnerabilities in Row Level Security (RLS) policies for Supabase tables, ensuring data is protected and access is properly controlled.

Core Features & Use Cases

RLS Status Check: Detects tables where RLS is not enabled.
Policy Analysis: Reviews existing policies for missing SELECT, INSERT, UPDATE, or DELETE permissions.
Security Advisor Integration: Leverages Supabase's built-in security advisors for deeper insights.
Fix Recommendations: Suggests specific SQL statements to enable RLS and create secure policies.
Use Case: After deploying new tables to your Supabase project, run this audit to ensure that sensitive data like user profiles or payment information is not exposed due to misconfigured RLS policies.

Quick Start

Run the Supabase RLS audit for all tables in the public schema.

Frequently Asked Questions about supabase-rls-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit Supabase RLS policies for security vulnerabilities?▼

To audit Supabase RLS policies, scan all tables in the public schema to identify missing RLS enforcement, incomplete CRUD policies, and permissive rules like USING (true), then apply generated SQL remediation statements to secure data access.

What happens if Supabase tables are missing Row Level Security policies?▼

Missing Row Level Security policies expose sensitive data like user profiles or payment information. An audit detects tables lacking critical SELECT, INSERT, UPDATE, or DELETE permissions and provides specific SQL statements to create secure policies.

How can I find overly permissive RLS rules in my Supabase database?▼

Find overly permissive RLS rules by analyzing existing policies for unsafe clauses such as USING (true). The audit flags these rules and suggests actionable SQL fixes to restrict unauthorized data access.

Does the Supabase RLS audit integrate with built-in security advisors?▼

Yes, the RLS audit integrates with Supabase's get_advisors tool to perform a comprehensive security assessment, combining custom policy analysis with native advisor insights for deeper vulnerability detection.

When should I run a Row Level Security audit on my Supabase project?▼

Run a Row Level Security audit immediately after deploying new tables to your Supabase project. This ensures that misconfigured RLS policies do not accidentally expose sensitive data to unauthorized users.

Can I check which Supabase tables have RLS disabled automatically?▼

Yes, you can automatically detect which Supabase tables have RLS disabled. The audit performs an RLS status check across the public schema and outputs SQL statements to enable RLS on unprotected tables.