Tool Gate · How it works
How the Supabase RLS Read-Off gate works
How the Supabase RLS Read-Off rolls eight tables into one verdict: policies resolve per table to locked, open, or public on purpose, and a service-role key reachable from the browser rewrites the whole matrix - the sample reads GAPS IN THE POLICIES with three of eight tables open and no RLS-on table among them.
How the gate works
This tool grades each table on whether its row-level security actually keeps other people out. It reads 8 tables and rolls them into one verdict — the worst, never the average — and then a gate that can only make it worse.
The 8 tables
| Table | Verdict |
|---|---|
| profiles | LOCKEDRLS on · every operation owner-scoped |
| orders | LOCKEDRLS on · open delete held by owner-only read |
| messages | OPEN TABLERLS off · all four operations open |
| documentsfix first | OPEN TABLERLS not found → off |
| plans | LOCKEDpublic read is intended · writes locked |
| blog_posts | OPEN TABLERLS off · writes open, read is fine |
| api_keys | LOCKEDRLS on · unfound delete held by owner-only read |
| audit_log | LOCKEDRLS on · writes have no policy |
The verdict bands
One fact rewrites the whole matrix. A service-role key reachable from the browser bypasses every policy you wrote, so every table resolves to OPEN TABLE no matter how carefully it was scoped. A table whose RLS state you could not find is scored as off — you get no credit for a lock you cannot confirm.
In the worked sample it reads GAPS IN THE POLICIES — Three of eight tables admit someone they shouldn't, and on all three the RLS badge is off or could not be found. orders and api_keys each carry a delete scored as admitting everyone and still read LOCKED: a delete only reaches rows the read policy shows, and both read policies are owner-only. The service-role key is not exposed here, so the project-level override never fires and the verdict stops one band short of the worst. Marked fix first on this sample: documents / delete — it holds other people's data and its RLS state could not be found, so it scores as off across every operation.
Common questions
Can every table look survivable on the Supabase RLS Read-Off gate and the company still read GAPS IN THE POLICIES?
Yes. The roll-up takes the worst of 8 tables — never the average — then a worsen-only gate, the Service-role override gate, escalates when trouble clusters. In the worked sample it reads GAPS IN THE POLICIES because three of eight tables admit someone they shouldn't, and on all three the RLS badge is off or could not be found. orders and api_keys each carry a delete scored as admitting everyone and still read LOCKED: a delete only reaches rows the read policy shows, and both read policies are owner-only. The service-role key is not exposed here, so the project-level override never fires and the verdict stops one band short of the worst.
What is a worsen-only gate?
A rule that can only lower a verdict, never raise it. One gate-triggering gap overrides an otherwise-set of survivable lines, because a single gate-triggering gap shouldn't hide behind an average of the healthy ones. Where something is short, the fix-first row names it — here, "documents / delete — it holds other people's data and its RLS state could not be found, so it scores as off across every operation".
Grades how a database is configured, never a person. Not a scanner or a penetration test — it reads back what you tell it, using rules you can see.
Embed this diagram
Free to share and embed with attribution (CC BY 4.0) — keep the link to redhub.ai.
Interactive — renders the live diagram
<iframe src="https://redhub.ai/visuals/tool/supabase-rls-read-off.html" title="How the Supabase RLS Read-Off gate works — RedHub AI" width="760" height="2064" loading="lazy" style="border:0;width:100%;max-width:760px"></iframe>
<p style="font:14px/1.5 system-ui,sans-serif"><a href="https://redhub.ai/visuals/tool/supabase-rls-read-off">How the Supabase RLS Read-Off gate works</a> — by <a href="https://redhub.ai">RedHub AI</a>, the AI that tells you when to doubt it.</p>Image + link — a static picture for any blog
<a href="https://redhub.ai/visuals/tool/supabase-rls-read-off"><img src="https://redhub.ai/visuals/tool/supabase-rls-read-off-share.png" alt="Diagram of the Supabase RLS Read-Off: eight tables, a service-role override gate, and a sample reading GAPS IN THE POLICIES." width="760" loading="lazy" style="max-width:100%;height:auto;border-radius:16px"></a>
<p style="font:14px/1.5 system-ui,sans-serif"><a href="https://redhub.ai">RedHub AI</a> — the AI that tells you when to doubt it.</p>
This is how Supabase RLS Read-Off works. More diagrams in the Visual Field Guide.