Automated RLS leak-testing tool for Supabase apps

What to build

A CLI tool for Supabase projects that spins up two disposable test accounts, then uses supabase-js to run cross-account select, update, insert, and delete probes against every table in the schema, printing a pass/fail security report before launch.

Solo Supabase builders routinely ship without verifying their Row Level Security policies actually isolate user data, and a scripted two-account CRUD probe can catch these misconfigurations automatically before launch.

Demand

Solo developers and small teams shipping fast on Supabase want a quick pre-launch security check they can run without manually writing cross-account test scripts for every table, especially as schemas grow past a handful of tables.

• r/SideProject (Reddit)News

  Reddit thread: Testing your RLS with two accounts before launch — builder shares the manual two-account check they run before shipping anything on Supabase.

• Supabase documentation (general knowledge)Context

  Supabase relies on PostgreSQL Row Level Security as its primary data isolation mechanism, and misconfigured RLS policies are a commonly cited risk for apps built on Supabase and similar BaaS platforms.

Stack

• supabase-js
• Node.js CLI (Commander or oclif)
• Supabase Admin API (for test account creation/teardown)
• PostgreSQL information_schema queries (to enumerate tables)
• GitHub Actions (for CI integration)

Solo + AI difficulty

The core loop — create two accounts via the Supabase admin API, enumerate tables, attempt CRUD as each account against the other's rows — is straightforward with AI assistance and doable in a few days; the harder part is handling edge cases like views, RPC functions, joins, and storage bucket policies without producing false negatives, which could take another week or two to make trustworthy. Time-to-MVP: roughly 1-2 weeks for a CLI covering plain tables.

Entry threshold

Needs only familiarity with Supabase's REST/client API and Postgres RLS semantics; a working CLI or script can be built in days with no capital or licenses, though earning trust for a security tool takes longer than typical micro-SaaS.

Window

6-12 months

Where to find first users

• r/Supabase
• r/SideProject
• Indie Hackers
• Product Hunt launch
• Supabase Discord community

Counter-signals & risks

• Solo builders and small teams who already skip manual security review for speed may also be unwilling to pay for or integrate an additional security tool, limiting willingness-to-pay despite the clear need.

• Supabase itself or third-party security scanning tools (e.g. existing Postgres/RLS linters, Supabase's own advisors) could add equivalent automated RLS testing natively, commoditizing or eliminating the market for a standalone paid tool.

• Automated cross-account testing may produce false negatives for complex RLS policies involving joins, views, functions, or role-based logic that simple CRUD probing across two accounts cannot fully exercise, limiting the tool's reliability guarantee.