Supabase RLS checker
Is your anon key safe? Paste your app URL (or project URL + anon key). We look for Supabase credentials and secrets in your JavaScript, then do read-only probes to see which tables anonymous visitors can read. Nothing is uploaded to NordKiln.
We fetch the HTML and JS bundles in your browser. If the site blocks CORS, use manual mode.
From Supabase → Project Settings → API. Never paste the service_role key. We do not store or send these values anywhere except your own project (read-only).
SELECT with limit=1. No inserts, updates, deletes, or storage of keys. Row contents are discarded and never shown.
Result
Grade A–F based on service_role leaks, open anon tables, and other secrets in client bundles.
Findings
Tables probed (anon key)
| Table | Anonymous read | Rows exist? | Detail |
|---|
“Rows exist” means the limit=1 query returned a row. We never display the data.
Recommended fixes
Want the full logged-in check?
This tool only tests anonymous access. The leak that sinks launches is often user B reading user A’s rows while logged in. NordKiln Scan (coming soon) does that with two test accounts.
No spam. One email when the scanner opens.
FAQ
Is my Supabase anon key safe?
The anon key is designed to be public in browser apps, but only if Row Level Security (RLS) is enabled and correctly scoped on every table. If anon can SELECT other users’ rows, the key is effectively unsafe.
What is a Supabase RLS checker?
A tool that uses your project’s anon key against the PostgREST API to see which tables anonymous clients can read. This page runs entirely in your browser and only performs read-only limit=1 probes.
What if a service_role key is in my frontend?
That is critical. service_role bypasses RLS. Rotate the key in the Supabase dashboard immediately and remove it from all client bundles.
Does this tool upload my keys?
No. NordKiln’s servers never receive your page contents, anon key, or table data. Network calls go from your browser to your app and your Supabase project only.
Why did the URL scan fail with CORS?
Browsers block reading many third-party sites from nordkiln.dev. Switch to manual mode and paste the project URL and anon key from Project Settings → API.
How it works
1. Find credentials
Scan HTML/JS for *.supabase.co, anon/service_role JWTs (via the role claim), and common secrets (OpenAI, Stripe, …) — shown masked.
2. List tables
GET /rest/v1/ OpenAPI with the anon key to discover exposed tables.
3. Probe reads
For each table, GET …?select=*&limit=1. We report readable yes/no and whether any row exists — never the row contents.