Supabase RLS security review: who can read the row

A green check beside Row Level Security is not a review.

Supabase’s database guide says a table in an exposed schema without RLS is readable and writable by any role that still has a grant, and that a policy does not remove that grant. The web application security review is $2,400 once for one app, $1,200 to start, written 48 hours after access works. You own the PDF. There is no subscription.

Short answer: A Supabase RLS security review is $2,400 once, with $1,200 to start, for one live app. I check the screens, the login, and the row policies those screens already trust, then write the report 48 hours after access works. You own it. A dashboard toggle and a multi-week accredited pentest are different products.

What does a Supabase RLS security review actually check?#

I sign in as the roles you already sell and record which customer rows those sessions can reach. The pass includes authentication, the calls that page already makes, and the grants, policies, and views behind them. The secret key that bypasses row security stays off the browser.

Supabase’s RLS guide is the bar, not a rumor:

• RLS on for every table in an exposed schema. Off means the grant is the only gate.
• Grants match the operation. Supabase says existing projects can hand anon and authenticated select, insert, update, and delete up front. A policy does not revoke that.
• The policy matches the role. anon is signed out. An allow-all rule for that role is public read of every row the grant already reaches.
• Views and the secret key. Supabase documents that views bypass RLS by default. The service role bypasses it entirely and belongs only in server code.

If the private data is a file, I name the bucket and the role that can read it. I do not include an attack recipe.

The same $2,400 is on pricing. A Next.js UI in front of this database is covered as a stack note in Next.js security review cost. That post does not walk the row policies.

	This review	Automated scan	Broader web app pentest
Price	$2,400 once, $1,200 to start	About $100–$3,000 for mostly automated work (WardenBit). Under about £1,200 is usually a scan (Solusec)	About $2,500–$15,000 for a small-business web app test (WardenBit). £1,500–£4,000 for a small UK web app (Solusec)
Clock	48 hours after access works	Minutes to a day	Days to a few weeks
Scope	Live UI, auth, grants, row policies, views, where the secret key lives	Known-bug list	Wider manual test, sometimes an accreditation letter
You keep	The PDF. One-time. No subscription	Often a tool login	That firm’s report
Not included	Exploit steps, infra red team, a schema rewrite, a badge I do not hold	Whether one customer can open another’s row	I do not sell this product

Buy the same review again at month 12 and month 24 and the three-year cash cost is $7,200, still one payment each time. That does not replace a CREST letter a contract named. Precursor prices a normal UK web application test around £3,750–£6,250. Different product.

What is not included for $2,400?#

You get a written review of one authorized app: severity, path, role, and a fix an engineer can ticket. I do not ship exploit steps, a schema rewrite, a second app, or a certificate I do not hold. The PDF is yours. There is no monthly fee on this price.

The document shape is the sample pentest report. No client names. A second production app, a mobile binary, a network red team, and a source audit of the whole repo are separate quotes. If the secret key is already in the browser, I write that down. Moving the calls server-side is your engineer’s job after the finding.

This is not AI Front Door, where a customer books or pays from ChatGPT, Claude, Grok, or another AI app that supports MCP connectors. MCP is the open standard those apps use to connect to a business’s tools. It is not Workflow Automation either. That offer is $3,500 once for one repeating ops job, such as an invoice chase, and it does not read your row policies.

How does the review run from access to the PDF?#

You authorize one URL, I use the test logins you send, and the report clock starts when that login works. Postgres decides which row a role can see. The PDF is what you keep. Your engineer tickets the change. I do not patch production inside this price.

Step	What happens
Trigger	A customer asked for a security packet, or real customer rows are about to land in the project
Action	I walk the live UI as each test role and compare that session to grants, policies, and views
System of record	The exposed tables, plus the written findings: severity, path, role, fix
Human escalation	You ticket the change. I do not edit production inside this price

Send written authorization for the URL, at least one working test user, and a second user when two customers must not see each other. Note anything that is supposed to be public. Give me a path to the engineer who owns the project so a question about a view does not sit in a founder translation layer.

When this isn’t the right move yet#

Do not pay the $1,200 if I cannot legally open the app, or if a buyer named a certificate this offer does not include. Get a URL and two test users first. A pass with no login is a homepage skim.

I will not guess a project from a screenshot. Wait if the demo is tomorrow and nobody can create a test account today. Hire the firm that holds CREST if the questionnaire requires that name. If the database is not Supabase, the same web application security review still covers auth and the API. Say so, so I am not hunting Postgres policies you do not have. A missed phone is the receptionist product, not this review.

What should be true before I start?#

Bring the URL, two roles, and one sentence on what is supposed to be public. I can start without a tour of the SQL editor. I cannot start without a login that behaves like production, or a public catalog becomes a false finding.

Before you pay, list the tables a signed-in customer reads, list what signed-out visitors must still see, and confirm the secret key is server-only. Confirm views over private tables are not the default bypass Supabase warns about. If two customers exist, write which records each one must never see. That sentence is the test.

If you want the layout before credentials, ask for the sample from the contact form.

$1,200 reserves the work on the review page. I confirm scope in writing before I start. If you would rather talk through the workflow for 20 minutes and see whether this fits, book a 20-minute call.