Supabase RLS Leak Demo
Reproduce a cross-tenant RLS leak and verify the fix
4 followers
Reproduce a cross-tenant RLS leak and verify the fix
4 followers
A tiny, runnable Supabase/Postgres security fixture that proves a policy can look correct and still leak rows across tenants. The same test suite runs red on the broken policy and green after the one-file fix. Start with npm ci && npm test—no Docker, cloud project, credentials, or production data required. Built for founders and developers who want evidence before shipping multi-tenant apps.
I built this after seeing teams treat “RLS enabled” as proof that tenant isolation works. It is not. A policy can pass happy-path checks while a relationship or ownership condition still exposes another tenant’s rows.
This repository makes the failure visible with one red/green fixture and the same test suite on both branches. You can inspect the SQL, reproduce the leak locally, and verify the minimal fix without sharing credentials.
If you find a pattern the fixture should cover, I’d genuinely like to hear it. For teams that want a second set of eyes, I also offer a fixed-scope 24-hour review of three sensitive tables. Launch offer: $15.20 total, $7.60 deposit today:
https://cengokurtoglu.gumroad.com/l/supabase-rls-3-table-review/LAUNCH20?utm_source=producthunt&utm_medium=maker_comment&utm_campaign=rls_review
Update: the fixed-scope review offer linked in my comment above has closed.
If you want to check your own RLS policies:
Free, 10 checks before production: cengokurtoglu.gumroad.com/l/nextjs-supabase-10-checks-free
- Full audit kit ($29, one-time) for the checks that need an outside read of your schema: cengokurtoglu.gumroad.com/l/supabase-rls-audit-kit
No pitch beyond that, just fixing a stale link.