An AI tool set up your database
Lovable, Bolt, Cursor or another tool created the tables, and nobody checked the rules.
Supabase security
Supabase security review for apps built with AI
We review the Supabase project behind your app for the gaps AI tools often leave: tables without Row Level Security, a service_role or secret key in the browser, public storage buckets and loose auth settings. Then we fix them for a price you approve first.
Who it's for
Is it for you?
Real users are about to sign up
You want to know your customers' data is private before you launch.
Something looks wrong
A user saw someone else's data, or Supabase shows a warning you don't understand.
What's included
What we check and fix
01
Row Level Security on every table
RLS turned on, with policies that let each user read and change only their own rows.
02
Keys where they belong
The service_role or secret key kept on the server, and rotated if it was ever exposed.
03
Private storage
Buckets private where they should be, with policies on who can upload and download.
04
Auth settings checked
Email confirmation, redirect URLs and password reset tested on your real domain.
TechnologiesSupabasePostgres RLSSupabase AuthSupabase StorageEdge FunctionsSQLTypeScript
-- invoices: private, per user
update storage.buckets
set public = false
where id = 'invoices';
create policy "own invoices"
on storage.objects for select
using (bucket_id = 'invoices'
and auth.uid()::text =
(storage.foldername(name))[1]);How it works
Start free. Pay only when it's worth it.
01
Free health check
A quick outside check of your live app, free.
02
App Rescue Audit · $299
A written report in 2 business days with what to fix first.
03
Fixed-price fix
We fix it in your repo for a price you approve first, and can keep watching it on Care from $249/month.
Brands we've worked for
Our team has worked with these brands. Logos belong to their respective owners.
FAQ
Questions about Supabase security
Is my Supabase app secure?
It depends on its rules, and AI tools often skip them. A table without Row Level Security can be read or changed by anyone with your public key, and that key ships with every page of your app. The review checks every table, bucket and key.
Is it a problem that my Supabase key is in the browser?
The anon or publishable key is meant to be public, as long as Row Level Security protects your tables. The service_role or secret key is different: it skips every rule, so it must only live on a server. If it was ever in your frontend code or your repo, rotate it.
Will turning on Row Level Security break my app?
It can, if the app relied on open tables. That's why we write the policies first, test each screen with real accounts and switch them on together, so nothing stops working for your users.
How much does a Supabase security review cost?
It's part of the App Rescue Audit. The App Rescue Audit costs $299 and you get a written report in 2 business days. If it finds no issue of medium or high severity, you get a full refund. If you start a plan within 30 days, the $299 is credited to your first month. Fixes get a fixed price you approve first.
Do you need my Supabase password or keys?
No. Invite us to your Supabase organization as a member, and to the GitHub repo if there is one. Never share passwords or secret keys in chats or forms.
Related services
You may also need
Fix a Lovable app
Supabase security, sign-in, Stripe and getting a Lovable app live on your own domain.
Learn more →Stripe payments for your app
Webhooks so access opens only after a real payment, subscriptions, the customer portal and the move to live keys.
Learn more →AI app rescue
Built with Lovable, Bolt or Cursor and stuck? We take it to production.
Learn more →Let's talk
Tell us what's broken
Not sure the audit is the right step? Tell us what's failing and we'll suggest the next step that fits.