for Supabase · free & open source

Ship Supabase apps
that don't leak.

Six MIT tools that make RLS the default plus the whole multi-tenant SaaS, already built.

Get the free tools → See pricing →
6 tools live on npm & GitHub · MIT · no signup to start
Finn, the ShipSealed seal that seals your app's leaks
bash
# scaffold a secure Next.js + Supabase app in one command
$ npx supabase-saas-kit new my-app
✓ auth · Row-Level Security · a test that proves tenant isolation

# gate RLS in CI — fails the build if a table ships exposed
$ npx airlock-rls
✗ payments: RLS DISABLED → exit 1 · this migration does not merge

Who it's for

Built for you if…

  • RLS is on, but no test proves tenants stay apart
  • A migration could ship with RLS off, unnoticed
  • Ownership logic is copy-pasted across tenant tables
  • CI runs your tests, but none check isolation

Not for you if…

  • You're not on Supabase / Postgres RLS
  • You don't use migrations or CI at all
  • Your app is single-user, so there's no tenant to isolate
  • You're shopping for a landing page template, not plumbing

The free tools

Open source, MIT, no signup. Each one makes the safe path the default — across RLS, auth, migrations, and abuse.

FREE · TEMPLATE nextjs-supabase-starter

Auth + one table with RLS + a test that proves isolation. Clone it and start on your product.

Use this template → FREE · npm supabase-saas-kit

The CLI: scaffold a project, check your env + Supabase connectivity, and generate RLS-safe migrations.

npx supabase-saas-kit new → FREE · npm + Action~1.4k ↓/mo · Jul 2026 airlock-rls

Stops the classic Supabase leak: a table shipped public. Fails the build when RLS is off or a policy is USING (true). Its paid tier, Airlock Monitor, is below.

npx airlock-rls → FREE · npm airlock-auth

Catches a server secret about to ship in the browser bundle. Fails the build on NEXT_PUBLIC_ secrets; warns on unauthed mutations and unverified webhooks.

npx airlock-auth → FREE · npm airlock-migrate

Catches a migration that quietly turns RLS off in prod. Fails the build on a new table without RLS, a disabled policy, or a dropped one. No database needed.

npx airlock-migrate → FREE · npm airlock-ratelimit

Drop-in rate limiting that doesn't punish families — keys authenticated requests by user, not shared IP. Token bucket, zero deps, typed.

npm i airlock-ratelimit →
◆ LIVE DEMO · REAL POSTGRES

Watch a cross-tenant leak get blocked

Same database, same tenant, same goal. One policy leaks, one blocks — and you can run the same request as the other tenant to prove the row was there all along.

Run the live demo →

Keep it sealed after launch

Airlock Monitor watches the database once real customers are in it.

● DAILY WATCH · SUBSCRIPTION · YOUR LONG-TERM GUARD

Airlock Monitor

CI checks the migrations you write. Airlock Monitor checks everything else your live database exposes — the surfaces that leak without a migration ever touching them. It re-audits every morning and emails you the moment one opens.

$19.99/mo
Start monitoring → No account needed — subscribe, we email your login link.
Cancel anytime · 14-day refund
what it watches
Tables with RLS turned off USING(true) / WITH CHECK(true) Storage buckets left public Realtime tables readable by anon SECURITY DEFINER functions that bypass RLS Views running as owner, ignoring RLS

Findings come ranked CRITICAL → LOW, plus a monthly report of what's still open. The first scan runs the moment you connect a project.

the email it sends 
Subject: Airlock detected 2 NEW RLS exposure(s) in acme-prod

  • invoices — table in "public" has RLS DISABLED — every
    row is exposed to the API roles
  • notes — [SELECT] any authenticated user reads all rows
    (cross-tenant) — USING(true)

These rows are reachable with the anon key. Fix the migration
or add an allow-rule for intentionally-public policies.
Just need one piece?
Kit Auth + RLS
  • login, signup, password reset + update
  • 3 migrations: workspaces, notes, tightened grants
  • 5 test files, incl. rls.test.ts (isolation) and rls.meta.test.ts (every table has a policy)
Get it → $39.99
Test Kit
  • 7 test files, wired and passing
  • Playwright e2e + config; Vitest for units and components
  • the RLS harness: rls.test.ts + rls.meta.test.ts
Get it → $29.99
UI Kit
  • Alert · Avatar · Badge · Button · Card · Collapsible · EmptyState · Input · LegendRow · Modal · Skeleton · Spinner · StatCard · Switch · Tabs
Get it → $4.99
Every piece is cut from the boilerplate itself: same repo, same tests. Get all three — $67.47 (COMBO10 applied)