What gets checked
- Every table: is row level security on, and do the policies match who should read and write
- Service role or secret keys shipped to the browser
- Storage buckets and their rules: public files that should be private
- Slow queries and missing indexes
- Auth settings: site URL, redirect URLs, email confirmation
What you get
- A written report in plain words, with the most dangerous problems first
- The fixes, applied to your project or as SQL you can run
- A short note on how to keep it safe as the app grows
Related guides
Quick answers
Why audit before launch?
Apps generated by AI tools often ship with row level security off or with policies that let any signed-in user read everyone's data. It is cheap to fix before real users show up and expensive after.
What access do you need?
Access to the Supabase project (as a team member) and to the repo, so the client code can be checked for exposed keys.
When do I pay?
After you see the report and the fixes working.