Tool Gate · How it works
How the Supabase RLS Read-Off gate works
How the Supabase RLS Read-Off rolls eight tables into one verdict: policies resolve per table to locked, open, or public on purpose, and a service-role key reachable from the browser rewrites the whole matrix - the sample reads GAPS IN THE POLICIES with two tables RLS-on yet open.
How the gate works
This tool grades each table on whether its row-level security actually keeps other people out. It reads 8 tables and rolls them into one verdict — the worst, never the average — and then a gate that can only make it worse.
The 8 tables
| Table | Verdict |
|---|---|
| profiles | LOCKEDRLS on · every operation owner-scoped |
| orders | OPEN TABLERLS on · delete admits everyone |
| messages | OPEN TABLERLS off · all four operations open |
| documentsfix first | OPEN TABLERLS not found → off |
| plans | LOCKEDpublic read is intended · writes locked |
| blog_posts | OPEN TABLERLS off · writes open, read is fine |
| api_keys | OPEN TABLERLS on · delete admits everyone |
| audit_log | LOCKEDRLS on · writes have no policy |
The verdict bands
One fact rewrites the whole matrix. A service-role key reachable from the browser bypasses every policy you wrote, so every table resolves to OPEN TABLE no matter how carefully it was scoped. A table whose RLS state you could not find is scored as off — you get no credit for a lock you cannot confirm.
In the worked sample it reads GAPS IN THE POLICIES — Five of eight tables admit someone they shouldn't. Two of them have the RLS badge switched on and are still open — the badge says protected while a delete policy admits everyone, which is the failure people never look for. The service-role key is not exposed here, so the project-level override never fires and the verdict stops one band short of the worst. The one thing to fix first: documents / delete — it holds other people's data and its RLS state could not be found, so it scores as off across every operation.
Common questions
Can every table look survivable on the How the Supabase RLS Read-Off gate works and the company still read GAPS IN THE POLICIES?
Yes. The roll-up takes the worst of 8 tables — never the average — then a worsen-only gate, the Service-role override gate, escalates when trouble clusters. In the worked sample it reads GAPS IN THE POLICIES because five of eight tables admit someone they shouldn't. Two of them have the RLS badge switched on and are still open — the badge says protected while a delete policy admits everyone, which is the failure people never look for. The service-role key is not exposed here, so the project-level override never fires and the verdict stops one band short of the worst.
What is a worsen-only gate?
A dispositive rule that can only lower a verdict, never raise it. One fatal flaw overrides an otherwise-set of survivable lines, because a single disqualifying gap shouldn't hide behind an average of the healthy ones. The tool also names the one thing to fix first — here, "documents / delete — it holds other people's data and its RLS state could not be found, so it scores as off across every operation".
Grades how a database is configured, never a person. Not a scanner or a penetration test — it reads back what you tell it, using rules you can see.
Embed this diagram
Free to share and embed with attribution (CC BY 4.0) — keep the link to redhub.ai.
Interactive — renders the live diagram
<iframe src="https://redhub.ai/visuals/tool/supabase-rls-read-off.html" title="How the Supabase RLS Read-Off gate works — RedHub AI" width="760" height="2064" loading="lazy" style="border:0;width:100%;max-width:760px"></iframe>
<p style="font:14px/1.5 system-ui,sans-serif"><a href="https://redhub.ai/visuals/tool/supabase-rls-read-off">How the Supabase RLS Read-Off gate works</a> — by <a href="https://redhub.ai">RedHub AI</a>, the AI that tells you when to doubt it.</p>Image + link — a static picture for any blog
<a href="https://redhub.ai/visuals/tool/supabase-rls-read-off"><img src="https://redhub.ai/visuals/tool/supabase-rls-read-off-share.png" alt="Diagram of the Supabase RLS Read-Off: eight tables, a service-role override gate, and a sample reading GAPS IN THE POLICIES." width="760" loading="lazy" style="max-width:100%;height:auto;border-radius:16px"></a>
<p style="font:14px/1.5 system-ui,sans-serif"><a href="https://redhub.ai">RedHub AI</a> — the AI that tells you when to doubt it.</p>
This is how Supabase RLS Read-Off works. More diagrams in the Visual Field Guide.