Configure access.
Add your project URL and public key.
Check access to your Supabase data.
Test what your Supabase project’s public key actually allows people to read. Check tables, RLS policies and storage for access that should not be open.
- Tables and RLS
- Storage Buckets
- Functions and API
Supabase
Tables
API REST
Storage
A public key should not open all doors.
An application can work perfectly with permissions that are too broad. VICE examines observable accesses and keeps the evidence alongside the finding.
View checksNeeds fixingNeeds recheckingFixed
Observations you can verify.
Review the evidence, identify the relevant check and prepare a fix. Findings keep their context between scans.
- Evidence associated with the finding
- Recommendations and a prompt for fixing the issue
- Confirmation by a comparable rescan
How to test your Supabase application
Run the checks.
Verify your domain, choose the specialized profile and run your scan.
Verify the fixes.
Review the evidence, apply changes and rerun the relevant tests.
Supabase checks, with context.
Tables and RLS
Find accessible tables and policies that expose data.
Storage Buckets
Check which files and storage buckets are publicly accessible.
Functions and API
Examine the entry points exposed by your project.
Authenticated access
Add a test session when a check requires authentication.
Multiple surfaces.
One platform to monitor them.
WordPressSet up your project URL and public key. In-depth scans require a verified domain and full-scan access.
Frequently asked questions
Start checking
the security of your site.
Find issues, prepare fixes and verify changes.
Keep your results together for the next deployment.
