Four ways to check Supabase RLS. What each one actually tests.
"RLS enabled" is a setting. Whether your policies stop another user is a result. These are the four ways people get from one to the other, in plain terms, with each tool's own words about its limits. Pick the one that fits the question you are asking today. Sometimes that is not RowAttest.
The one-question guide
- Why does this one policy fail for this one query? Use Supabase's RLS Tester.
- Did I forget RLS or leave a rule wide open? Run Lovable's Quick scan or Supabase's Security Advisor.
- I know SQL and want to audit it myself on my schedule. Buy or write a SQL audit kit.
- I want someone else to sign in as another user, try every table, and give me a result I can hand to a customer. Run RowAttest.
Side by side
| Supabase RLS Tester | Lovable Quick and Deep scan | SQL audit kit (for example the $29 kit) | RowAttest | |
|---|---|---|---|---|
| What it does | Runs one SQL query as a chosen user and shows which policies were evaluated | Reads your database rules and app code and flags risky patterns | Catalog queries you run yourself, plus an optional two-user harness for staging | Creates temporary users, tries reads and writes across every table through your public API, records what came back |
| Writes (INSERT, UPDATE, DELETE) | Not yet. "Only SELECT queries are supported for now." | Flags rules that look wrong; does not execute writes | The optional harness can make real writes on staging | Yes, as synthetic rows that belong to the test users |
| Runs as a second user | Yes, one role at a time | No. "Static analysis by reading your code and configuration" | Yes, if you set up the two staging users and run the harness | Yes, test users and the anonymous visitor, created and removed by the run |
| Storage buckets | No | Database rules and code | Storage checks included in the SQL files | Yes, bucket settings, with uploaded test objects removed at teardown |
| Output | On-screen result in the dashboard | Findings list in Lovable | Your own report, written by you | Browser result on the free plan; signed PDF and JSON with a public verify link on a paid run |
| Can a third party verify it | No | No | No | Yes, at rowattest.com/verify, no account needed |
| Price | Included with Supabase (feature preview) | Included with Lovable | $29 one time, plus your hours | Free: 10 runs a month, unverified. $49 per signed report |
| Best for | Debugging one policy | Catching the obvious before you publish | Developers who want to own the audit | Proof you can give someone else, repeated after every migration |
Honest notes, in each tool's own words
Supabase, on the RLS Tester: "Verifying the correctness of your RLS policies set up has always been a gap." It is a feature preview, and "Only SELECT queries are supported for now to simplify things." Mutations are kept out while Supabase works out a safe way to support them.
Lovable, on its scanners: "The built-in scanners and Wiz perform static analysis by reading your code and configuration to flag patterns that look risky." Lovable adds that these tools "cannot guarantee complete security" and suggests a professional review for apps handling sensitive data. Lovable also offers AI penetration testing as a separate dynamic step.
The $29 kit, on itself: diagnostic and verification tooling, not a penetration test or security certification. Results need human review.
RowAttest, on itself: not a linter, not a checklist, and not a test of Supabase's own platform. "A clean run says nothing about platform vulnerabilities." A check reports PASS only when two independent paths agree; when only one path can run, the verdict is marked provisional. A leak is reported only from an observed signal: a row that came back or a write that landed. Connect a staging or test project you own, not production.
Sources: Supabase changelog, Lovable security docs, Supabase RLS Audit Kit, RowAttest methodology.
Where RowAttest is the wrong choice
- You want to know why a specific policy behaves the way it does. The RLS Tester shows you the evaluated policies; RowAttest shows you the outcome.
- You cannot create a staging copy of your project. RowAttest tests only projects you connect for that purpose.
- You need a compliance certificate or a full application pen test. RowAttest covers RLS policies, grants and bucket settings, nothing else.
Start with the free two-minute self-check at rowattest.com/self-check. If any answer is no, run a free RowAttest test on a staging copy. Pay $49 only when you need the result signed.