VibeVigilGuides · VibeVigil
What is row level security?
Row level security decides which rows a stranger can read in Supabase. If it is off, the anon key can read the table.
Scan a site you own. It is free. No account.
You see the report first. Saving the site is optional.
Row level security, or RLS, is a rule on a Supabase table. It decides who can read or write each row.
The anon key ships in your app. That is normal. The key is not a secret. The rules are what keep data private.
If a table has no rule, a stranger with the anon key can read it.
What a scan does
If the public JavaScript contains a Supabase project URL and an anon key, the scan asks the public API which tables exist. Then it tries a read-only select with a limit of one row.
It reports the table name only. It does not store the row. It does not use the service role key.
An empty result is not proof the table is safe. A row coming back means a stranger can read it.
What to do
Turn on row level security for tables that hold user data. Add a policy that limits rows to the signed-in user. Paste the fix note from your report into your coding agent and read it before you apply it.
The page explains the check. A scan uses your URL.
You see the report before you make an account.