# RLS Checker

> RLS Checker is a free, read-only Supabase RLS checker. It tests observable anonymous table reads from the public application path without signup or DNS verification.

Canonical site: https://rlschecker.com/
French version: https://rlschecker.com/fr/
Publisher: Webba Creative Technologies
Method reviewed: 2026-07-14

## What the tool does

- Accepts the public HTTPS URL of an application.
- Looks for a Supabase project URL and a publishable or legacy anon key in public client resources.
- Builds a limited inventory from table names observable in those public resources.
- Sends small, bounded anonymous read requests only.
- Separates readable rows, rejected requests and empty or inconclusive responses.
- Returns no row contents, API keys or sensitive field paths in the public report.

## Important limits

- The inventory is not guaranteed to include every table, view, function or policy in a Supabase project.
- An empty response does not prove that RLS is correct. The table may be empty or its rows may be filtered.
- The quick check does not assess authenticated roles, Supabase Storage, Auth or server-side code.
- RLS Checker is an external runtime observation, not a certification or replacement for project-level testing.

## Primary sources

- Supabase Row Level Security: https://supabase.com/docs/guides/database/postgres/row-level-security
- Supabase API keys: https://supabase.com/docs/guides/getting-started/api-keys
- Supabase database advisors: https://supabase.com/docs/guides/database/database-advisors

## VICE engine

RLS Checker uses a narrow contract derived from the open-source VICE security engine:
https://github.com/Webba-Creative-Technologies/vice

This file is a concise discovery aid. The canonical HTML pages and sitemap remain the authoritative public inventory.