Open-sourced an RLS policy linter for Supabase projects

Close

Catches the table you forgot to protect.

It reads your migrations and reports three things: tables with row level security off, tables with it on but no policy at all, and policies that reference auth.uid() inside a function that runs as definer. That last one is the quiet dangerous case.

Cursor wrote the SQL parser wrapper. The rules themselves I wrote by hand from mistakes I have made and reviewed. It found two real problems in my own projects on the first run, which was humbling.