Automatically test your Row Level Security policies. We query your database exactly like an attacker would to verify your data is protected.
Row Level Security (RLS) is a PostgreSQL feature that controls which rows users can access in a table. It's your database's last line of defense—without it, anyone with your API credentials can access all data.
SELECT * FROM users;
→ Returns ALL users
SELECT * FROM users;
→ Returns only YOUR data
We attempt to query your tables without authentication to verify anonymous users can't read data.
Tests whether authenticated users can access other users' data by manipulating queries.
Automatically discovers all tables in your database and checks each one for RLS policies.
Reports which tables have RLS enabled but may have overly permissive policies.
PostgreSQL + RLS
Serverless Postgres
MySQL (similar concepts)
Self-hosted or cloud
RLS is enabled but you haven't created any policies yet. Without policies, RLS blocks EVERYTHING by default. You need to create SELECT/INSERT/UPDATE/DELETE policies that define who can access what. VAS shows exactly which tables are exposed and provides policy templates.
Option 1: Use VAS to automatically test your tables with the anon key. Option 2: Manually test in Supabase SQL Editor with 'set role anon' then query your tables. If you can read data you shouldn't, your policies are wrong.
CREATE POLICY "Users see own data" ON your_table FOR SELECT USING (auth.uid() = user_id). This ensures the authenticated user's ID matches the user_id column. Apply similar policies for INSERT, UPDATE, DELETE. VAS provides these templates for your specific tables.
Anon key: Public, subject to RLS policies, safe for frontend. Service role key: BYPASSES ALL RLS, full database access, NEVER expose in frontend. If service_role key leaks, attackers have complete database access regardless of RLS.
RLS adds minimal overhead when policies are simple (auth.uid() checks). Performance issues come from complex policies with subqueries. For most apps, the security benefit far outweighs the negligible performance cost. Always use RLS for multi-tenant data.
Find out exactly which tables are exposed before someone else does.
Start Free Scan