Can your users read each other's data?
A common leak in AI-built apps is not a missing rule. It is a rule that exists but only checks that someone is logged in — so any user who signs up can read everyone's rows. A check that only asks "is RLS on?" passes these apps.
RLS Review reads your table settings and rules, then tells you in plain words who can read, change or delete what — with the SQL to fix each problem. Free. Runs in your browser. Nothing is uploaded.
Copy this read-only query
It reads table settings and rules (policies). It never reads your rows and changes nothing.
loading…
Run it in Supabase
Open your project at supabase.com → SQL Editor → New query → paste → Run. On Lovable Cloud (no Supabase dashboard)? Ask the Lovable chat: "Run this read-only SQL on my database and show me the raw result", then paste what it returns.
Paste the result here
Click the one cell in the result (it starts with
{"tool":"rls-review"), copy it and paste below.
What it checks
Who can read
Tables with RLS off · rules open to everyone · rules that let any logged-in user read other users' rows · views that skip your rules.
Who can change
Rules that let users edit or delete rows that are not theirs · create rows in someone else's name · hand their rows to another user.
Back doors
Functions that run with full rights and anyone can call · rules that trust user_metadata · public file buckets · storage rules open to all.
Not checked (yet): keys inside your website code, auth settings, edge functions, rate limits. A clean report is a good sign, not a guarantee.
Want a reviewer's eye?
Free check
Every rule finding above, with the SQL to fix it. Unlimited.
Full review
An AI reviewer reads your whole schema the way a security freelancer would: which tables hold private data, which rules fit how your app works, one ready migration file, and a short report you can show a client. Re-check free after you fix.
For comparison: founders on freelance sites pay $500–$3,000 for a security review of a Lovable + Supabase app (job posts, November 2026).
Questions
Is it safe to paste my result here?
The result holds table names, column names and rule text — no rows, no keys, no passwords. The review runs in this page with JavaScript; the text never leaves your browser. We only count that a review ran (no content).
Why not just use Supabase's Security Advisor?
Use it too — it is free and good. It warns about RLS being off and about rules that are "always true" for writes. It does not judge read rules that only check "is logged in", which is the most common leak in AI-built apps, and it does not write the fix for your table.
My app was built with Lovable / Bolt / Base44. Does this work?
Yes, if the app stores data in Supabase (Lovable Cloud is Supabase). Base44's own built-in database is not Supabase, so this check only covers Base44 apps that use a Supabase backend.
A finding is wrong for my app.
Some tables are meant to be public (products, blog posts). The check marks those as "info". If a finding still looks wrong, it may be — the tool reads rules, not your intentions. That is what the full review is for.