Rowly is a free security scanner that audits Row Level Security policies in your Supabase project.
Rowly reads the actual policy logic across every table, view, function, and role in your project, flags exactly what's exposed, and hands you ready-to-run SQL to fix it, no manual rewriting. Connection strings are never stored, scans run in memory only, and the core scanner is open source (@rowly/core, MIT).
Free to run in seconds:
Open Source scanner:
PopKoren introduces Rowly, a security scanner for auditing Row Level Security (RLS) policies in Supabase projects. It analyzes policy logic across tables, views, functions, and roles, providing SQL fixes. PeterBuildsSecure suggests improvements, questioning if Rowly checks for FORCE RLS settings and SECURITY DEFINER functions, which are critical for preventing data leaks.
This is a good idea for a focused tool. One thing worth confirming it covers, since it's the gap that bites people even when every policy looks airtight: does it check whether FORCE ROW LEVEL SECURITY is set on each table? By default RLS doesn't apply to the table owner or to roles with BYPASSRLS, so a project can have well-written policies on every table and still leak data through any code path that runs as the owner (migration scripts, some server-side clients) unless FORCE is explicitly set. Same question for SECURITY DEFINER functions — a function defined with elevated privileges runs with the definer's permissions regardless of what RLS says, so an audit of "every table, view, function, and role" should really flag any SECURITY DEFINER function touching a protected table, not just check whether the table has RLS enabled. Those two are the ones that show up in real projects that otherwise look correctly configured.