Rowly

Features

Everything Rowly checks

Anyone can reach your domain. Rowly finds out what they can actually do - no credentials required.

Rowly is a Supabase configuration security scanner - not a general vulnerability scanner. Along the way, it also checks supporting web-security basics like headers, TLS, and DNS.

Run a free audit
58/ 100

Security Health Score

Score out of 100 based on total findings. Lower means more issues detected across tables, functions, roles, and database config.

Elevated risk detected. Review critical findings and apply hardening SQL.

24 CHECKS · 4 CRITICAL · 9 WARNING · 11 SECURE

Critical Warning Secure

Tables Scanned

18

Secure Tables

11

of 18 with no issues

Warnings

9

5 tables · includes functions & config

Critical Findings

4

0 RLS off · check functions & roles below

Total Findings

13

warnings + critical across all layers

Coverage

What an outsider can actually reach

Rowly starts from your public domain, discovers any Supabase project in client-side code, then probes that surface with only the public anon key - the same vantage point a real attacker has.

Discovery

  • Homepage & JS bundles
  • Anon / publishable keys
  • Custom API domains
  • Leaked service_role keys
  • Sourcemaps & .env / .git

Data API

  • Anon table reads
  • OpenAPI method grants
  • Canary INSERT / DELETE
  • GraphQL introspection
  • Extra API schemas

Auth & storage

  • Signup & confirmations
  • Anonymous sign-ins
  • Public storage buckets
  • Canary uploads
  • JS-referenced buckets

Realtime & gateway

  • Realtime subscriptions
  • Realtime REST
  • API CORS
  • Edge Function names
  • DNS / TLS / headers

No integration required

Just a domain. Nothing installed.

Rowly checks your app the way an external attacker would, then tells you what it found - without a database password or an agent to deploy.

A domain is the whole setup

No agent to deploy, no SDK to install, no OAuth app to authorize, no database password to hand over. Type your domain and the scan starts.

Reads what's public, nothing more

Rowly reads your site's public homepage and JavaScript, then probes any discovered Supabase project using only its public anon key - the same surface a real attacker sees. Canary writes create a new object and delete that same object only; existing rows and files are never touched.

No database password, ever

Saved projects store only a domain. Rowly never asks for a connection string, service_role key, or any credential that could reach inside your database.

Why Rowly

Built for what others miss

Supabase Security Advisor needs your project dashboard. Generic scanners never touch your live API. Rowly attacks the public surface an outsider already has.

8/8Rowly
1/8Supabase Security Advisor
1/8Generic SAST scanners

Scans from a public domain alone

No database password or service_role key. Rowly discovers your Supabase project from public HTML/JS the same way a browser would.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Proves anonymous data exposure

Live anon-key probes: table SELECT, OpenAPI write grants, canary INSERT/DELETE of scanner-owned rows, and GraphQL when REST is locked down.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Storage, Auth, Realtime, and gateway

Public buckets, canary uploads, signup/confirmation posture, Realtime listen, API CORS, and dangerous gateway paths - not just table RLS toggles.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Catches leaked secrets in client code

Flags service_role / sb_secret keys, sourcemaps, .env, and .git when they are reachable from the outside.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Honest about what it cannot see

RLS policy SQL, function bodies, triggers, and authenticated-only policies stay listed as gaps - never silently marked clean.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Ready-to-run remediation guidance

Every finding includes plain-English risk and remediation SQL or dashboard steps you can apply immediately.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Findings rated by confidence

High when the probe proves exposure (e.g. live row data or a successful canary write); medium when it needs a human look.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

Never mutates your existing data

Canary writes only create a new scanner-owned row or file, then delete that same object. Existing customer data is never patched or removed.

  • Rowly
  • Supabase Security Advisor
  • Generic SAST scanners

External attack surface

Live probes, not a checklist

Rowly discovers your Supabase project from public HTML and JS, then hits REST, Storage, Auth, GraphQL, and Realtime with only the anon key. Anonymous reads are checked on every scan; canary writes and account-creation probes run once you verify the domain, and never touch your existing rows.

Run free audit
  • Anon reads
  • Canary writes
  • Auth posture
  • Realtime

External attack surface

5 findings · sorted by risk

  • "invoices" returned live row data to an unauthenticated request using only the public anon key. This is exactly what an external attacker without credentials would see.

  • "profiles" accepted an anonymous INSERT and returned the new canary row. An external attacker can create rows without signing in.

  • A Supabase service_role/secret key was found in publicly served HTML/JavaScript. This key bypasses Row Level Security entirely.

  • Bucket "receipts" is marked public. Anyone can download its files without signing in.

  • The project's public auth settings report autoconfirm is on. Attackers can create accounts using email addresses they do not own.

Fixes included

Every finding ships with the fix

Each finding comes in plain English, ranked by confidence and severity, with remediation SQL or dashboard steps - plus a combined fix-all script for every finding in a category.

Run free audit
  • Plain English
  • Exact SQL fix
  • Fix-all script
  • Severity ranked

Every finding ships with the fix

Findings are ranked by severity and confidence, and each one carries the remediation SQL or dashboard steps to run.

  • "invoices" returned live row data to an unauthenticated request using only the public anon key. This is exactly what an external attacker without credentials would see.

Fix SQL

-- Lock down anonymous SELECT on public."invoices"
-- Dashboard: Table Editor → invoices → Policies → remove anon SELECT / tighten USING
ALTER TABLE public."invoices" ENABLE ROW LEVEL SECURITY;
REVOKE SELECT ON public.invoices FROM anon;

Fix row level security

5 findings · Combined remediation script

Domain verification

Two testing tiers, by design

Anyone can point Rowly at a domain and get a read-only audit instantly. Full active testing - the checks that write data, create accounts, or call your functions - only runs once you prove you actually control that domain.

Every scan, no setup

Read-only checks

Runs the moment you type a domain in. Nothing here writes data, creates accounts, or calls your functions - it's everything an outside visitor's browser can already see.

  • Security headers (HSTS, CSP, X-Frame-Options, and more)
  • TLS certificate validity and expiry
  • DNS posture: SPF, DMARC, CAA
  • Exposed .git and .env files
  • Exposed JavaScript sourcemaps
  • Leaked Supabase anon and service_role keys in public JS
  • Anonymous REST reads with the public anon key (proves open RLS)
  • Table and RPC schema enumeration
  • GraphQL schema introspection
  • Storage bucket listing and public-bucket exposure
  • CORS policy and dangerous gateway paths
  • Auth configuration disclosure

Unlocked by verification

Full active testing

Once your domain is verified, Rowly also proves exploitability directly: it writes canary data, creates a throwaway test account, and calls your RPCs and Edge Functions to see what an anonymous attacker could actually do.

  • Canary INSERT + DELETE on tables (proves anonymous write access)
  • Canary GraphQL mutation insert
  • Canary file upload to storage buckets
  • Auth canaries: signup, password recovery, magic link/OTP
  • Anonymous sign-in probe
  • Authenticated-role table reads via a canary session
  • RPC function invokes
  • Edge Function invokes

Verifying takes one DNS record

Add a TXT record at _rowly-verify.yourdomain.com with the token Rowly gives you, then click "check now". Same model as Google Search Console or Vercel domain verification - we never ask for a database password or admin access, only proof you control DNS.

No password, ever

This split exists so Rowly only takes exploit-style actions - writes, test signups, function calls - against domains you've proven you own, never against a domain someone else submitted.

Features

Built to catch leaks before your users do

Scan any domain in under a minute

Type a domain and Rowly discovers what's publicly exposed in seconds - no database password, no agent, no SDK to install.

Works with the stack you already ship

Built for Supabase-backed apps on Next.js, Vite, Expo and more. If your frontend talks to Supabase, Rowly can see what an outsider can reach.

Alerts only on what's new

Rowly re-scans on a schedule and diffs against the last run, so you're pinged when a new vulnerability appears, not by the same noise every day.

Prioritized by data sensitivity

Findings are ranked by what's actually at risk, from emails and tokens to cards and passwords, so you fix what matters first.

Shareable audit reports

Export a full PDF report with every finding and its SQL fix, ready to hand to a client, a teammate, or a security reviewer.

Pricing

Start free, upgrade when you ship

Compare all plans

Free

$0

Run a manual audit and see exactly where you leak.

  • 1 active project
  • Manual scans only
  • Security score history
Start free

Pro

…/mo

billed monthly

Continuous monitoring with alerts on new vulnerabilities.

  • Multiple projects (up to 25)
  • Automated daily → monthly scans
  • Slack & email security alerts
  • Team members & invites
  • Weekly security digest
Get started

Enterprise

Custom

For agencies and teams shipping many client apps.

  • Everything in Pro
  • SSO (Single Sign-On)
  • Audit logs
  • Custom compliance reports
  • Priority support
Contact sales

Ready to ship without leaking?

Audit your Supabase project in under a minute. No signup, no credit card required.

Run a free audit