After reading that 83% of Supabase data exposures come from RLS misconfiguration (and the CVE-2025-48757 story with 170+ vibe-coded apps), I built a small open-source CLI that connects read-only to your Postgres/Supabase DB and flags common RLS mistakes: RLS disabled entirely, USING (true) policies open to anon, unauthenticated write access, and the classic "INSERT works but .select() fails" trap.
▎ https://github.com/redekerlouis-ai/rls-auditor
Runs local, never sends your data anywhere, read-only connection. Would love feedback from anyone who's hit RLS issues before — does this catch what actually bit you?
The user has developed an open-source CLI tool to audit Supabase RLS policies, aiming to identify common misconfigurations. They are seeking feedback from the community to ensure the tool effectively addresses real-world RLS issues.