Your Supabase app passed the security scan.
Your data may still be public.

Supabase's Security Advisor and Lovable's scan check whether row level security is on. They mostly don't check whether your policies are right. RLS Check reads your policies and tells you, in plain English, who can reach what.

1 Copy this query

It only reads your access rules (policies, grants and bucket settings). It does not read any data in your tables and changes nothing.

Loading…

2 Run it in Supabase

Open your project → SQL Editor → New query, paste, and click Run. You get one row with one value in the rls_check column. Click the value and copy it.

3 Paste the result

What it checks

Signed-out visitors skipping the owner check
A policy like auth.uid() is null or user_id = auth.uid() looks like an owner check, but every signed-out request has a null auth.uid(), so it gets every row. The Security Advisor doesn't flag it.
Users who can make themselves admin
If users may update their own profile and the table has a role, is_admin, plan or credits column, they can change it from the browser. We also find the policies that trust that column.
"Everyone" and "any signed-in user" read policies
using (true) on a table with emails, phone numbers or addresses, or auth.uid() is not null where sign-up is open to anyone.
Anyone can edit or delete other people's rows
Update and delete policies that check that someone is signed in, but not that they own the row.
Storage buckets anyone can list
A storage policy that only checks bucket_id lets anyone list and download every file, even in a private bucket.
And the basics
Tables with RLS off, views that skip RLS, policies that trust user_metadata, and tables anyone can fill with spam. Findings the Supabase Security Advisor also reports are marked, so you know what's new.

Questions

Is it safe to run the query?
It is a single select on Postgres system catalogs: pg_class, pg_policies, grant checks and storage.buckets. It reads table and column names, never their contents. Read it before you run it; it's short.
Do you see my data?
No. The check runs in this page with JavaScript. The result you paste never leaves your browser.
Is this a full security audit?
No. It checks database and storage access rules, which is where most leaks in AI-built apps come from. It doesn't test your edge functions, API keys in your code or your app's logic.

Guides