01 · Inspect
Map every reachable path
Review RLS coverage, policy commands, grants, views, security-definer functions, Storage, Realtime and sensitive columns.
Supabase · PostgreSQL · Digital download
Test the RLS boundary your dashboard cannot prove.
A structured toolkit for finding cross-user and cross-tenant access gaps in Supabase projects: seven SQL audits, 60 checks, a two-user staging runner and reporting templates you can reuse.
Inside the ZIP
Evidence, not a green badge
Start with the 15-minute path, complete the full eight-pass review, then record every failure and untested path instead of turning missing evidence into a false pass.
- 017 commented SQL audit files for coverage, policies, write gates, grants, bypass paths, Storage, Realtime and safe role simulation
- 0260 checks arranged into eight passes, from surface mapping to two-user verification
- 03Optional Node.js harness that signs in as two ordinary staging users and tests the tenant boundary
- 04Audit report, remediation plan, safe-test checklist and fix-SQL cookbook
- 05Reference guide to 12 common RLS failure mechanisms and a single-team commercial license
02 · Verify
Cross the boundary on staging
Sign in as two ordinary users from different tenants and test reads, writes, ownership reassignment and anonymous access.
03 · Report
Prioritize fixes and re-test
Turn findings into a client-ready report and remediation plan, then repeat the full audit after changes.
Before you buy
Scope and safety
Does the kit change my production database?
Files 01-06 use read-only catalog queries. File 07 wraps its role-simulation probes in BEGIN and ROLLBACK. The optional Node.js harness can perform real API writes, so it is explicitly for staging or another approved test environment.
Does the harness need a service-role key?
No. It uses the public project key and two ordinary test-user accounts. A service-role key bypasses RLS and would make the isolation test meaningless.
Can I use the templates for client work?
Yes. The included single-team commercial license permits completed reports and remediation plans for direct clients. Reselling or redistributing the kit itself is not permitted.
Is this a penetration test or security certification?
No. It is diagnostic and verification tooling. Results require human review and do not certify that an application is secure or compliant.
Prefer a human review?
See the fixed-scope Supabase RLS security audit from $299 on Upwork.