RowAttest Pre-launch

Signed proof that strangers can't read your users' data.

RowAttest runs real cross-tenant attack attempts against your Supabase app and signs what it finds.

Pre-launch. Limited early slots.

We use your address only to contact you about early access.

attestation-RA-SAMPLE0001.jsonSigned

RowAttest Attestation Report

RA-SAMPLE0001 · SAMPLE

92Pass
1Fail
12Not evaluated
0Error

1 of 93 evaluated boundaries failed: a seeded attacker in one tenant could reach another tenant's data.

Ed25519 signature

sig 08bf19…8bc90b · sha256 0d0b83…cfbf97

Why this exists

One missing policy is the whole breach.

With row-level security enforced, Tenant A's request for Tenant B's rows is refused by the database itself.

This is not rare. One missing policy exposed 170+ apps (CVE-2025-48757), and a scan of 380,000 vibe-coded apps found the same class of gap again and again.

Sources: Flowpatrol, “The Lovable RLS Leak: 170+ Apps, 303 Open Endpoints, and a Database You Could Query From the Browser” (disclosed 2025-05-29) · r/vibecoding, “Researchers scanned 380,000 vibe-coded apps. Here's what they actually found.”

RowAttest runs these attempts for real and signs the result.

  • Tenant enclosure
  • Rows
  • Request
  • Policy gate
  • Signed report

Sample attestation

What a report looks like, and how to check it hasn't been altered.

A sanitized excerpt for a fictional app. The signature underneath is real: your browser checks it against the demo public key. Edit the report and it stops verifying.

Sample · synthetic data RA-SAMPLE0001

RowAttest Attestation Report

RA-SAMPLE0001 · SAMPLE

Sample. Synthetic data throughout. “Tasklio” is a fictional demo application built by RowAttest to show the report format. Names and identifiers are placeholders; the signature in the block below is a real Ed25519 signature over this excerpt's canonical JSON, made with a demo key.

1 · Header

Project ref
tasklio-demo (fictional)
Environment
declared as staging by the customer
Run window (UTC)
2026-09-18 14:02:11 → 14:09:47
Engine
v0.1.0-sample
Issued by
RW Digital Ventures LLC (RowAttest)

2 · Executive summary

1 of 93 evaluated boundaries failed: a seeded attacker in one tenant could reach another tenant's data. Details in the findings section.

  • 92

    Pass

  • 1

    Fail

  • 12

    Not evaluated

  • 0

    Error

92 checks passed.

Coverage: 7 of 8 tables evaluated (84 cells) plus 1 storage bucket (9 cells); 1 table not evaluated (12 cells, unknown tenancy).

5 · Finding F-1 · cross-tenant UPDATE on tasks

What was accessed
A task row belonging to tenant A (synthetic row rowattest_synthetic_task_a1) was modified by a user in tenant B
As whom
Seeded user [email protected] (tenant B, role: member)
Reproduction
PATCH /rest/v1/tasks?id=eq.<synthetic-id> with tenant-B access token, header Prefer: return=representation; body {"title": "changed-by-b"}
Evidence
HTTP 200; response body contains the modified row (1 row returned, synthetic row only)
Detected by
Layer A (API) and Layer B (policy simulation), both agree
Fix direction
The UPDATE policy on tasks checks membership in USING but has no WITH CHECK, and the USING clause does not compare org_id. Add an org_id membership check to both clauses.

8 · Signature block

Report SHA-256 (canonical JSON)
0d0b8385f6fa968afaba9aa7e2ac396717d5605bfafea3d395aea76e0ccfbf97differs from the signed hash
Ed25519 signature
08bf197e72e038ed797cb60f39b593768abe8edeecac409ba7412ee935e6b60cd676dcf9609c0d355deedf92ba87fbe5a7b2d8935e6c224500d388108e8bc90b
Demo public key (Ed25519)
0a751ebe666571509fda8763a81bb54b74fcf333b3b86d61d0b2df47f3a086c5
Key fingerprint (SHA-256)
c7e4b86705e7ded0a2456f623345fb8c099eb95cdea3dfa6e760b206509e76a7

Production reports are signed with a separate key and carry a public verify link; no account is needed to check one. This sample is signed with a demo key, and you can check it right here.

Not yet verified

This checks the report's signature — it proves the document is unaltered, not that your app is safe.

How it works

Three steps, one artifact.

  1. 01

    Connect a staging project

    Point RowAttest at a staging Supabase project you are authorized to test. Production is out of scope.

  2. 02

    The eight-stage engine runs

    It reads the security surface, infers the tenancy model, seeds its own attacker accounts, executes the cross-tenant matrix, keeps the evidence and tears everything down.

    • preflight
    • static-introspection
    • tenancy-inference
    • attacker-seeding
    • matrix-generation
    • execution
    • evidence-capture
    • teardown

  3. 03

    Signed attestation, public verify link

    The report is hashed and signed with Ed25519. Anyone you hand it to can check it without an account.

    • report-signing

Status

Where this stands.

Status
Pre-launch. RowAttest is not yet available. The waitlist is for the alpha.
Capacity
The alpha is limited to what one founder can serve.
Scope
Testing runs only against staging environments, with written authorization from the project owner.
This page
The report above is a sample for a fictional app. Nothing on this page is a customer result.

Get early access.

Leave an email and we'll contact you when an alpha slot opens.