The VICE engine is open source→
Modules

Supabase Deep Scan

Every table, every policy, every storage bucket. VICE audits the RLS layer generic scanners don't understand, built for the stack you ship on.

public.userspublic.users · anon role can read every row

What makes the Supabase Deep Scan different?

You save your project URL and anon key once per domain. VICE then checks what those public credentials can actually reach: tables without RLS, permissive policies, exposed storage buckets and edge functions.

Evidence, not vibes

Every finding keeps its raw evidence next to the remediation, so you can verify the problem is real before you fix it.

$ GET acme.dev/.env200 OK# .env · productionDATABASE_URL=••••••••••••STRIPE_SECRET_KEY=sk_live_51H…SUPABASE_SERVICE_ROLE=••••••RESEND_API_KEY=••••••••

An AI fix for every finding

Each finding ships with a plain-language explanation and the exact patch. Paste it into Cursor or your migration and move on.

-- ai fix · missing-rls-policy
- grant select on public.users to anon;
+ alter table public.users
+   enable row level security;
+ create policy "own rows" on public.users
+   for select using (auth.uid() = id);

Resources