Supabase RLS Check — Is Your Database Publicly Readable?
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee.
What the issue is
Your Supabase database answers anonymous requests with real rows, meaning anyone who knows your project URL can read — and sometimes change — user data. This is the fastest way an AI-built app gets breached.
Why AI tools generate it
Lovable and other AI builders scaffold Supabase with Row Level Security disabled by default, so a vibe-coded app can ship a fully open database without ever being told it's public.
How DevMeth detects it
A read-only live probe queries your Supabase API the way any visitor can (anonymous, no key, no login) and checks whether tables return rows. We read a few rows at most and never modify anything.
Your Supabase database is readable by anyone on the internet
WHAT WE FOUND
table users — 1,204 rows readable anonymously · sample row masked
The fix, in three steps
Enable RLS on every table and attach policies anchored to auth.uid() instead of USING (true). The fix prompt includes the exact ALTER TABLE and CREATE POLICY statements and a verification line.
Run a free scan and each finding carries a paste-ready fix prompt you can act on.
Try a free scanFAQ
Is my Lovable app with Supabase vulnerable by default?
Very commonly — AI builders disable RLS by default, so a freshly scaffolded app's database can be readable by anyone with the project URL. It's worth a 2-minute check.
Does the scan modify my data?
No. The probe is read-only and caps itself at a handful of rows; it never writes, deletes, or touches your production data beyond a minimal anonymous read.
What's the actual fix?
Enable Row Level Security on every exposed table and add policies scoped to the logged-in user (auth.uid()), keeping service-role/admin access server-side only.
DevMeth checks the 48 known AI-code failure patterns — not a penetration test or a security guarantee. A clear result means each known pattern was checked and found clear or not applicable for your app; it is not a guarantee of security.