Skip to content
Get a quote

Supabase RLS FixesFix your Supabase RLS before you launch

When row-level security is off or a policy is too loose, a signed-in user, sometimes anyone, can read or change other customers’ rows. The Launch Check finds and confirms each issue against your running app; the Rescue Sprint fixes the worst as pull requests with tests.

Fixed prices

All fixed-price offers

Something else? Describe your project

What we fix

What we check in your policies

  • 01

    Row-level security never enabled

    The table has policies, but RLS is off, so they are ignored and every role with a grant can read and change every row.

  • 02

    Policies that trust user_metadata

    Any signed-in user can edit their own user_metadata. Roles move to app_metadata or a roles table users can’t write to.

  • 03

    Users who can edit other people’s rows

    A user can update rows that aren’t theirs. Both using and with check get matched to (select auth.uid()).

    Check a migration free

  • 04

    Storage buckets anyone can list

    Read policies that expose every file in a bucket, limited to the owner’s folder.

  • 05

    Tables that need grants after October 30, 2026

    New tables aren’t exposed to the Data API by default, so each needs an explicit grant or supabase-js returns “permission denied”.

    Check your migrations free

  • 06

    Functions that bypass RLS

    Security definer functions callable by anyone, revoked from public and anon and granted only to the roles that need them.

Running in production

Free tools and a sample report

App369 built these checkers and runs them on app369.com. They read only the SQL you paste, so you can see what they flag before you pay for anything.

  • Supabase RLS policy checker

    Flags policies that trust user_metadata, updates without with check, open storage reads and functions anyone can call.

  • Supabase October 30 grants checker

    Lists the tables in your migrations that need an explicit grant.

  • A sample Launch Check

    The findings for the RLS checker’s example migration, each rated critical, high, medium or low, are on the Launch Check page, so you can see the report format first.

  • Supabase
  • PostgreSQL
  • Row-level security
  • supabase-js
  • Supabase Storage
  • Next.js
  • React

Questions

Before you start

Can I check my policies myself first?

Yes. Paste a migration into the free Supabase RLS policy checker. It reads only the SQL you paste. The Launch Check also confirms each issue against your running app.

What does the Launch Check report look like?

The Launch Check is a written check of your whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed, plus a fixed price to fix the worst problems (the Rescue Sprint). No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

I know the one policy that’s wrong and can show how to reproduce it. Which do I buy?

The App Fix Ticket fixes one reproducible bug as a pull request with a regression test. If you’re not sure what else is open, start with the Launch Check.

Do you need my production data?

No. Send the supabase/migrations folder or a schema export with no user data, plus a test login.

Not a fixed-price job?

Describe it and get a written quote

Send what you need built or fixed. You get a written scope, a fixed price and a timeline; we reply by email, usually within one business day.

Describe your project Instant quote

Prefer a call? Consultations are $100 per 15 minutes, paid upfront.