Open-sourced an RLS policy linter for Supabase projects

Close

Catches the table you forgot to protect.

It reads your migrations and reports three things: tables with row level security off, tables with it on but no policy at all, and policies that reference auth.uid() inside a function that runs as definer. That last one is the quiet dangerous case.

Cursor wrote the SQL parser wrapper. The rules themselves I wrote by hand from mistakes I have made and reviewed. It found two real problems in my own projects on the first run, which was humbling.

The security definer check is great, that's the one I see most in reviews. hannah_reyes 3 weeks ago

Ran it on two client projects. Found a table with RLS on and no policies, which the app had "fixed" by switching to the service role key. jb_supa 3 weeks ago

That's exactly the pattern it was made for. mira_dev 3 weeks ago

Can I run this on a Lovable project? Mine doesn't have a migrations folder. noor_builds 3 weeks ago

Yes, point it at the output of pg_dump --schema-only instead of the migrations. mira_dev 3 weeks ago