Automatically test your Row Level Security policies and find data exposure vulnerabilities before attackers do.
Every Supabase app exposes the anon key in client-side JavaScript. This is by design—but without proper Row Level Security, anyone can use it to read, modify, or delete ALL your data.
// An attacker opens DevTools and runs:
const { data } = await supabase.from('users').select('*');
// Without RLS: Returns ALL user data
We actively query your tables using the anon key to verify RLS policies are working. If we can read data, so can attackers.
Automatically discovers exposed tables and reports exactly which ones are leaking data and what fields are accessible.
Checks your Supabase Auth setup for weak password policies, missing email confirmation, and insecure redirect URLs.
Tests storage bucket policies to ensure uploaded files aren't publicly accessible when they shouldn't be.
Paste your Supabase app URL. We automatically detect your Supabase project.
Our scanner finds your Supabase URL and anon key from your frontend code.
We query your database tables using the anon key, exactly like an attacker would.
Receive a detailed report showing exposed tables, missing RLS, and exact fixes.
Your Supabase anon key is visible in your frontend JavaScript - this is expected and by design. The anon key itself isn't a secret. However, without Row Level Security (RLS) enabled, anyone with that key can read ALL your data. Use VAS to test if your tables are actually protected.
Common reasons RLS fails: 1) RLS is enabled but no policies are defined (blocks everything), 2) Policies use auth.uid() but users aren't authenticated, 3) Policies have logic errors allowing unintended access. VAS tests your actual RLS configuration by querying tables like an attacker would.
First, enable RLS on all tables with sensitive data: ALTER TABLE your_table ENABLE ROW LEVEL SECURITY. Then create policies defining who can access what. VAS scan results include the exact SQL commands needed to secure your specific exposed tables.
If RLS isn't properly configured, yes - anyone can use your anon key to read, insert, update, or delete data. The anon key is public by design; your database security depends entirely on RLS policies. Run a VAS scan to find out if your data is exposed.
Enable RLS on ALL tables, create restrictive policies (deny by default), use auth.uid() to scope data to users, never expose service_role key in frontend, validate inputs server-side, and regularly test your RLS with tools like VAS to catch misconfigurations.
Don't wait for a data breach. Find out exactly which tables are exposed and get the SQL to fix them.
Start Free ScanFree scan checks security headers. Full scan tests RLS policies.