Supabase RLS Checker: Can Anyone Read Your Data?
If Row Level Security is off on a table in an exposed schema, anyone with your publishable key, which ships in your frontend, can read it. Enter your project URL and key to test each table from your browser. Nothing is sent to us.
Results appear here.
Not tested: storage buckets, RPC functions, views you didn't name, and writes (insert, update, delete).
What the results mean
Exposed
A request with only your public key returned at least one row. Anyone can read this table. Fix it now.
No rows visible
The table answered with an empty list. Either RLS is blocking reads, or the table is empty. This is not a pass: an empty table fills up later, and a policy can allow rows you didn't test.
Blocked
Supabase refused the read because the public role has no access to the table.
Not found
No table with that name in the public schema. Check the spelling, or the schema it lives in.
Why you have to name your tables
Since 8 April 2026 Supabase no longer returns the API's table list to public keys, so a browser tool can't discover your tables for you. Paste the table names, or paste code that calls supabase.from("table") and the tool reads the names out of it. Storage bucket calls are ignored. Details in the Supabase changelog.
How to fix an exposed table
Enable RLS on the table, then add a policy that lets each user read only their own rows. The tool gives you the SQL for each exposed table. Test your app afterwards, because RLS without a policy blocks your own reads too. The full walkthrough is in Supabase RLS for AI-built apps.
Questions about the checker
Is my key sent to you?
No. The requests go straight from your browser to your own Supabase project. Nothing is sent to our servers, the key is held only in the page while it is open, and it is not saved.
Is it safe to paste the publishable key?
Yes. The publishable key (or the legacy anon key) is public by design and ships in your frontend. Never paste a secret or service_role key: this tool refuses them without sending anything, and if one was ever in your frontend or repo you should rotate it.
Why isn't "no rows visible" a pass?
An empty answer has two causes you can't tell apart from outside: RLS is blocking reads, or the table has no rows yet. A table that is empty today becomes a leak the day your first customer signs up, so confirm RLS is enabled in the dashboard.
Does it test writes?
No. It only sends read requests. It does not test inserts, updates or deletes, storage buckets, RPC functions or views you didn't name.
Does it work with a custom domain?
No. Only project URLs of the form https://<project-ref>.supabase.co are supported, so the tool can only ever send requests to Supabase.
Can I test a project that isn't mine?
Only with permission. Run it against your own project or one you are allowed to test. The tool asks you to confirm this, and caps each run at 70 tables: one read-only request per table, plus one count request for each table found exposed.
Want a full check of your AI-built app? We'll do it.
A security and cost audit of your app: exposed tables, leaked keys, missing limits, and what to fix first.