Onboarding founders now
The Supabase dashboard tells you if RLS is missing. It doesn't tell you what an attacker can actually do with your anon key. Misconfigured policies, overly permissive functions, open endpoints, auth gaps in edge functions. That's where things break.
Supasec probes your project from the outside, finds what the built-in advisor misses, gives you the prompts to fix it, then keeps watching. Every deploy. Automatically.
Get a free scan when we launchNot just "is RLS enabled?" We make real requests with your anon key and map what comes back. Misconfigured policies that look fine in the dashboard but leak data in practice. Edge functions that skip auth. Endpoints you forgot existed.
For every issue we find, you get a prompt you can drop straight into your AI coding assistant. It explains what's wrong and exactly what to change.
The table `public.profiles` has RLS enabled, but the existing SELECT policy uses `true` as the condition. This means any request with the anon key can read every row, including email addresses and metadata.
Replace the SELECT policy with one that restricts reads to rows where `id = auth.uid()`. If other users need to see profiles, add a separate policy scoped to specific columns.
After you apply the fix, we run the scan again to confirm it actually worked. Then we monitor continuously so the next deploy doesn't reopen what you just closed.
Connect your repo. We watch your dependencies for known vulnerabilities and open PRs to fix them automatically.
An AI agent connected to your GitHub repo that finds security issues in your code and submits fixes as pull requests.
We're onboarding a small group of founders first. Drop your details and we'll set you up.
You're on the list. We'll be in touch.