RedHub AI
How the roll-up gate works
How the Supabase RLS Read-Off gate works
This tool grades each table on whether its row-level security actually keeps other people out. It reads 8 tables and rolls them into one verdict — the worst, never the average — then a gate that can only make it worse.
The 8 tables
One fact rewrites the whole matrix. A service-role key reachable from the browser bypasses every policy you wrote, so every table resolves to OPEN TABLE no matter how carefully it was scoped. A table whose RLS state you could not find is scored as off — you get no credit for a lock you cannot confirm.
Why: Five of eight tables admit someone they shouldn't. Two of them have the RLS badge switched on and are still open — the badge says protected while a delete policy admits everyone, which is the failure people never look for. The service-role key is not exposed here, so the project-level override never fires and the verdict stops one band short of the worst.
No single table is the crisis — the clustering is. The roll-up takes the worst, the gate escalates when trouble compounds, and it names the one thing to fix first. Grades how a database is configured, never a person. Not a scanner or a penetration test — it reads back what you tell it, using rules you can see.