Supabase security: RLS, keys and policies, the checklist
Supabase is the favourite database of apps generated with Lovable, Bolt or Cursor. Its model is powerful: the browser talks directly to the database, and Row Level Security (RLS) rules decide who sees what.
This model has a simple consequence: a table without RLS, or with an overly broad policy, is open to anyone who opens your site. It is the number one flaw in vibe-coded apps.
Ten free analyses every month, no card needed. First report in minutes.
Analyse my app for freeThe most common flaws
RLS disabled on a table
The public anon key then grants full read and write access.
USING (true) or WITH CHECK (true) policies
RLS is on, but it lets everything through: the result is the same.
service_role key on the client
This key ignores RLS. It must only exist on the server.
Public Storage buckets
Invoices, ID documents and private files dropped into a public bucket are reachable by their URL.
What Citadel checks (6 live checks)
Code, dependency and secret analysis against OWASP and CWE. Every flaw comes with a plain explanation and the fix prompt to paste into your assistant.
- service_role key used in client code CWE-798 · A07
- Tables exposed without Row Level Security enabled CWE-284 · A01
- Permissive policies: USING (true) or WITH CHECK (true) CWE-284 · A01
- Secrets in the code and config files (100+ key types) CWE-798 · A07
- npm and Composer dependencies with published CVEs or GHSA advisories A06 · CVSS
- Passwords hashed with MD5, SHA-1 or unsalted CWE-916 · A02
Frequently asked questions
How do I know if RLS is enabled on my tables?
In the Supabase dashboard, each table shows whether RLS is on. For a complete check, Citadel reads your SQL migrations and flags tables without RLS and overly permissive policies.
Is my code kept?
No. It is analysed in an isolated container with no internet access, then deleted as soon as the analysis ends. Only the results are kept, with secrets masked.
How much does it cost?
The Free plan includes ten analyses a month, no card needed. Paid plans add Citadel AI, analysis on every push and team work.
Other guides
Vibe coding security: the checklist before you put your app online