Verify the policies protecting your data.
A public Supabase key is expected. Broad row-level security policies, privileged server keys in browser code and incomplete ownership checks are not. We test the actual boundaries around your data.
Who it is for
Built for products where trust matters.
- Supabase apps preparing for launch
- Multi-tenant SaaS products
- Apps using generated RLS policies
- Products with storage or edge functions
What we review
A focused review of the complete risk surface.
Supabase security audits covering row-level security, roles, storage, edge functions, secrets and cross-account access.
Anonymous and authenticated access
Service-role key handling
Storage buckets and object ownership
Edge functions and API authorization
Cross-account reads, writes and deletes
Issues we investigate
Specific findings, not generic warnings.
The report identifies the affected table, policy, endpoint or bucket and explains how to reproduce and close the access path.
RLS disabled or incomplete
A table is reachable through the API without the ownership rule the interface assumes.
Writable ownership fields
Users can change organization, role or owner identifiers on their own records.
Public storage exposure
Sensitive uploads are enumerable or accessible without the expected authorization.
Service-role leakage
A privileged key appears in browser code or a publicly reachable function response.
The deliverable
Evidence your team can act on.
The report identifies the affected table, policy, endpoint or bucket and explains how to reproduce and close the access path.
Explore the sample report →Every finding includesSeverity and priorityEvidence and reproductionBusiness and user impactPractical remediation
Questions
Good to know.
Need help choosing a scope? Contact the audit team directly.
Is the Supabase anon key a secret?+
No. It is designed to be public. Your RLS policies and server-side handling must enforce what that key can do.
Do you need database credentials?+
We begin with the least privilege needed. Deeper policy and configuration review is agreed during onboarding.
Do you test storage policies?+
Yes, storage access and object ownership are included when storage is part of the agreed scope.
Ready when you are
Find the issues before users do.
Choose the audit depth that fits your application and receive a clear, prioritized report.
View audit plans →