Keyboard shortcuts

jk
move through the list
↵
open the selected item
a
ask a question
nucw
tabs: new, unanswered, active, top
⌘↵
post the answer you are writing
/or⌘K
search
t
switch theme
?
this list
AskVibe
AskSign in
Demo, all content is generated
Showcase
Visit project ↗

Open-sourced an RLS policy linter for Supabase projects

Open · 3401 views · asked by mira_dev · edited
cursorsupabasepostgressecurity

Catches the table you forgot to protect.

It reads your migrations and reports three things: tables with row level security off, tables with it on but no policy at all, and policies that reference auth.uid() inside a function that runs as definer. That last one is the quiet dangerous case.

Cursor wrote the SQL parser wrapper. The rules themselves I wrote by hand from mistakes I have made and reviewed. It found two real problems in my own projects on the first run, which was humbling.

Comment
The security definer check is great, that's the one I see most in reviews. hannah_reyes · edited
Ran it on two client projects. Found a table with RLS on and no policies, which the app had "fixed" by switching to the service role key. jb_supa · edited
That's exactly the pattern it was made for. mira_dev · edited
Can I run this on a Lovable project? Mine doesn't have a migrations folder. noor_builds · edited
Yes, point it at the output of pg_dump --schema-only instead of the migrations. mira_dev · edited

Activity