Supabase Security Scanner

RLS is on. That doesn’t mean you’re safe.<br>Rowly audits every policy in your Supabase project, shows you which ones actually leave data exposed, and gives you the exact SQL to close each gap.

Connection stringDomain

PostgreSQL connection string<br>Run free audit<br>Connection strings are never stored. Scanning is in-memory only.

How do I get my connection string?1Open your Supabase project<br>Go to supabase.com/dashboard and select the project you want to scan.

2Navigate to Database settings<br>Click the gear icon (Project Settings) in the sidebar, then open the Database tab.

3Copy the Session pooler connection string<br>Click Connect at the top of the dashboard, then under Session pooler copy the URI . The pooler host (pooler.supabase.com) is required - the Direct connection host is IPv6-only and is not reachable from this hosted scanner.

4Replace the password placeholder<br>Swap [YOUR-PASSWORD] with your database password. Find or reset it on the same Database page under Database password .

Example format<br>postgresql://postgres.xxxxx:your-password@aws-0-region.pooler.supabase.com:5432/postgres<br>Tip: You can change your database password after the scan completes for additional security.

See everything Rowly checks

© 2026 Rowly. All rights reserved.