Home / Compare / Supabase RLS tools
Comparison · Supabase RLS checking tools
Five ways to check Supabase RLS — and when to use each one
TL;DR
"RLS enabled" is a setting. Whether your policies actually stop another user from reading the data is a result. These are five ways people get from one to the other. Pick the one that fits the question you're asking today. Sometimes that's not Airlock.
The quick guide
Match the tool to the question
- Why does this one policy behave this way? → Use Supabase's RLS Tester — it shows you which policies were evaluated for a specific query.
- Did I forget to turn on RLS or leave a setting wide open? → Run the Supabase Security Advisor or Lovable's Quick scan — they catch configuration problems fast.
- I know SQL and want to audit it myself, on my schedule. → Buy or write a SQL audit kit and run the queries yourself.
- I want someone else to sign in as two users, try every table, and give me a signed result I can hand to a customer. → Run RowAttest on a staging project.
- I want continuous automated checks that catch regressions after every migration, with fix suggestions. → Connect Airlock Monitor.
Side by side
Fair and high-level — feature sets and prices change, so verify current details on each tool's site (links in the sources section). This is about what each tool checks and how, which is stable.
| Tool | What it does | Tests writes? | Cross-tenant? | Continuous? | Auto-fix SQL? | Signed report? | MCP? | CI gate? | Price |
|---|---|---|---|---|---|---|---|---|---|
| Supabase RLS Tester | Runs one SQL query as a chosen role and shows which policies were evaluated | No — SELECT only (preview) | Yes, one role at a time | No — manual, in the dashboard | No | No | No | No | Free (included with Supabase) |
| Supabase Security Advisor | Checks project settings and flags common misconfigurations | No — reads settings, not data | No | No — manual, in the dashboard | No | No | No | No | Free (included with Supabase) |
| Lovable Quick & Deep scan | Static analysis of your code and database configuration to flag risky patterns | No — static analysis only | No | Partial — runs on deploy in Lovable | No | No | No | No | Free (included with Lovable) |
| SQL audit kit ($29) | Catalog queries you run yourself, plus an optional two-user harness for staging | Optional — if you set up the harness | Optional — two staging users, manual | No — you run it when you want | No | No | No | No | $29 one-time |
| RowAttest | Creates temporary users, runs real reads and writes across tenants through the API, signs the result | Yes — real writes, rolled back or torn down | Yes — seeded test users across tenants | On-demand — 10 free runs/month | Fix direction (text), not SQL | Yes — Ed25519 signed PDF, public verify link | Yes — 7 MCP tools | Yes — gate npm package |
Free: 10 runs/mo. Signed: $49/run. Pro: $99/mo |
| Airlock Monitor | Continuous static + dynamic analysis (anon DAST + cross-tenant DAST), signed attestation, auto-fix SQL, MCP + CI gate | Yes — anonymous write probes + cross-tenant CRUD via the REST API | Yes — creates two temp users, seeds a row as A, attacks as B (SELECT/INSERT/UPDATE/DELETE) | Yes — automated on a schedule (weekly free, hourly paid) | Yes — copy-paste SQL fix for every finding | Yes — Ed25519 signed attestation, verifiable at shipsealed.com/verify | Yes — 7 MCP tools (2 local + 5 hosted Monitor) | Yes — npx airlock-gate (exit 1 on leak) + npx airlock-rls |
Free: 1 project, weekly. Pro: $19.99/mo (14-day trial) |
Honest notes
In each tool's own words, or from what we verified ourselves:
- Supabase RLS Tester: "Verifying the correctness of your RLS policies set up has always been a gap." Feature preview — "Only SELECT queries are supported for now to simplify things."
- Supabase Security Advisor: checks settings like RLS enabled, leaked keys, and email confirmation. A project health check, not an isolation test.
- Lovable: "The built-in scanners perform static analysis by reading your code and configuration to flag patterns that look risky." They add that these tools "cannot guarantee complete security."
- SQL audit kit ($29): "Diagnostic and verification tooling, not a penetration test or security certification. Results need human review."
- RowAttest: "Not a linter, not a checklist, and not a test of Supabase's own platform." A check reports PASS only when two independent paths agree; when only one path can run, the verdict is marked provisional. Staging only.
- Airlock Monitor: not a penetration test — it reads catalog metadata, probes the REST API as the anonymous caller, and (when given a service_role key) creates temporary authenticated users to test cross-tenant isolation with real CRUD attacks. It catches RLS-off tables, permissive policies, unscoped reads, missing write checks, exposed SECURITY DEFINER functions, public buckets, anonymous data leaks, and cross-tenant leaks between authenticated users. Reports are signed with Ed25519 and verifiable without an account.
When Airlock Monitor is the wrong choice
- You need to debug why a specific policy behaves the way it does. The RLS Tester shows the evaluated policies for a single query — we show the outcome, not the internal evaluation trace.
- You want an independent third party signing your reports. RowAttest is a separate company — their signature proves they ran the test, not you. Our Ed25519 attestation proves the report is untampered, but we are the tool and the signer. If the audit needs to come from an independent party, use RowAttest.
- You need a full application penetration test or compliance certificate. None of these tools cover that — hire a pen tester.
When Airlock Monitor is the right choice
- You want continuous automated checks that run after every migration and catch regressions before they reach users — not a one-time scan you have to remember to run.
- You want copy-paste SQL fixes, not just a finding — every Airlock finding comes with the exact SQL to fix it.
- You're building and want the fastest feedback loop. Connect once, and the monitor watches your database on a schedule. No setup per run.
- You want free coverage for a side project. The free tier gives you weekly checks on one project — no card, no time limit.
The bottom line
There is no single tool that covers everything. The Supabase built-ins are free and catch the obvious — start there. Add a dedicated tool when your app handles real user data and you want to catch regressions before they ship.
Pick the one that fits the question you're asking today. Sometimes that's not Airlock.
Start on Airlock Free ← Back to ShipSealed
Sources (pages read November 2026; verify current details before you rely on this table):
Supabase RLS Tester docs · Supabase Security Advisor · Lovable security docs · RowAttest methodology · RowAttest comparison · ShipSealed / Airlock Monitor