Free tool
Supabase RLS checker
Enter your app’s URL to see whether it exposes a Supabase key to the public, and understand what that means for your data. If your app is Supabase-backed, Row Level Security is the one thing standing between a public key and an open database.
This check is passive. We read only what your app already serves to any visitor and never read from your database. To prove whether a table is actually open, run a full scan after verifying you own the domain.
Why the anon key alone is not the story
Every Supabase app ships a public anon key to the browser. That is normal. The real question is whether Row Level Security is on for every table, because that is what decides if the public key can read your data or not. We scanned real AI-built apps and found that many exposed the anon key, and more than one in four of those had at least one table anyone could read. Read the open database study or the RLS checklist for AI apps.
Frequently asked questions
What does this Supabase RLS checker do?
It fetches your app's public URL and looks at what the page serves to any visitor: the HTML and its JavaScript bundles. If it finds a Supabase project URL and an anon key, it tells you your app is Supabase-backed and that your safety now depends entirely on Row Level Security. If it finds a service_role key in client code, that is a critical exposure. The check is passive: it never reads from your database.
Is it bad that my Supabase anon key is public?
No, the anon key is meant to be public. It ships to the browser by design so your frontend can talk to Supabase. The anon key is only dangerous when Row Level Security is off, because then the key that everyone can see is enough to read or write your tables directly. The key being visible is expected; RLS being off is the actual problem.
What is Row Level Security?
Row Level Security (RLS) is Supabase's per-row access control. With RLS on and correct policies, the anon key can only see the rows a policy explicitly allows. With RLS off, any request carrying the public anon key can read the entire table. RLS is the line between a normal, safe Supabase app and an open database, which is why it is the single most important setting to get right.
Why won't the tool just read my tables and tell me if RLS is off?
Because we cannot prove from the outside that the URL you entered is yours. Actively reading tables on any domain a stranger typed in would turn this into a tool for finding open databases, which we will not build. The public check stays passive. Once you verify you own the domain, a full scan can safely test each table with your own anon key and show you exactly which ones RLS is not protecting.
The check found no Supabase key. Am I safe?
It is a good sign, but not a guarantee. Your keys may load on a route the checker did not fetch, or only after a user interaction, or your app may not use Supabase at all. If you do use Supabase, confirm RLS is enabled on every table regardless of what this passive check sees.
RLS is one setting. Your app has more.
An exposed anon key with RLS off is one of several mistakes AI coding tools ship by default, alongside hardcoded secrets, missing auth checks, and JWTs decoded without verifying. Prbl scans your whole app for the full set.
Run a free scan