Free Supabase check · no login · no keys · no uploads

Could one user read another user's data?

Supabase makes building fast. It also makes it dangerously easy to ship an app where the UI looks private while the database policy is too wide. Run this before a real user becomes your security test.

Run the exposure check Book a $99 one-flow preflight

Leak path 01

RLS exists, but the policy is too broad.

`authenticated` is not the same as `owns this row` or `belongs to this org`.

Leak path 02

The UI filters data, but the database does not.

If privacy depends on a React filter, a direct request can bypass the illusion.

Leak path 03

Storage, RPC, or admin routes escape the policy.

Files, functions, and service-role paths need the same ownership proof as tables.

10 focused checks

Can your auth and data boundary survive a two-user test?

Projects, messages, uploads, usage, billing mirrors, prompts, and generated outputs all count.

“Any authenticated user” is usually not a privacy boundary.

Service-role access belongs only in trusted server paths with tight input checks.

Private table policies do not automatically protect every file path or preview URL.

A server endpoint can accidentally bypass client-side assumptions.

The useful proof is not “Alice can see Alice.” It is “Alice cannot see Bob.”

Multi-tenant apps often leak through stale local state or incomplete membership checks.

Live updates can leak data even when ordinary page loads look safe.

Admin convenience often becomes accidental production exposure.

This is the smallest useful proof before inviting real users or clients.

When the checker exposes risk

Send one auth/data flow. Get a practical next step.

If your app has Supabase auth, RLS, storage, org switching, or private AI outputs, describe the one flow you are worried about. Keep it public and non-sensitive.

Do not send passwords, tokens, API keys, private customer data, database dumps, or private files. This is a lightweight intake path for a fixed-scope review.

If it looks like a fit, the next step is the fixed-scope $99 one-flow preflight. No passwords, keys, database dumps, private customer data, or sensitive files.

Related check

Run the full launch simulator

Check payment, auth, data, AI output, support recovery, and launch confidence.

Open simulator

Need a second pass?

$99 one-flow preflight

One app, one critical flow, 10 checks, repro notes, and a 2-day action plan.

Book the preflight

Payment path too?

Stripe final-state checker

If auth is safe but payment state is shaky, check webhooks, entitlement, refunds, and retries.

Check Stripe state