Security tool · Supabase authorization

Prove your Supabase data boundaries before release.

Last updated:

RLSProof looks for concrete authorization risks in a bounded set of files from a public GitHub repository. It reports what it found, what it did not cover, and never turns skipped or unavailable coverage into a PASS.

Public GitHub repositories only No GitHub token Browser-side evaluation Coverage stays explicit

Free Quick Scan

Scan a public repository

Enter owner/repo or a normal https://github.com/owner/repo URL. The browser requests public repository metadata and selected public blobs directly from api.github.com; repository contents are not uploaded to a NovaTools server.

Limits: 18 selected files · 128 KiB/file · 1 MiB total · 5,000 tree entries · 50,000 KiB repository size. Unauthenticated GitHub API rate limits apply.

Ready. No repository has been scanned yet.

Coverage boundary

Quick Scan is intentionally incomplete.

The free browser surface runs bounded native static checks only. It does not run Gitleaks, OSV-Scanner, Opengrep, database authorization fixtures, private-repository analysis, or full tenant-isolation proof. A clean bounded result therefore remains incomplete, not PASS.

For full repository coverage, the open-source RLSProof GitHub Action can run pinned external scanners in your own CI runner, while database proof remains a separate isolated test layer.

Inspect RLSProof source GitHub Action documentation NovaTools security

Human-reviewed service

Launch Verification

$149 USD one-time

Payment activation pending

Full scanner coverage, reviewed findings, remediation guidance, and a fix → re-test evidence report before launch. Payment checkout is not presented as active until the payment provider has approved and enabled the live flow.

Launch Verification is not a security certification, compliance attestation, penetration test, or guarantee of security.

Contact about Launch Verification Refund Policy Privacy Policy Terms of Service

Why the result stays auditable

RLSProof uses deterministic rules rather than an AI model to decide security findings or release-gate status. Evidence is redacted for common secret formats before it is displayed, and high or critical unresolved findings block the gate. API errors, repository-size limits, truncated trees and rate limits produce an error instead of a successful result.