rustine.io/en/tools/supabase-checker
Who can read your Supabase database without signing in?
Paste your project's address and its public (anon) key, the one already in your app. The test runs in your browser: our servers never touch your project.
We count readable rows, we download no data. Never paste the service_role key here.
| Table | Without signing in | Visible rows | What it means |
|---|
The fix to paste into your AI
Supabase no longer gives the table list to a public key: we looked for the most common names. Add yours to check them too.
In your browserThe test runs from your computer, with the key your app already publishes. Rustine never receives your key, your project's address or your data.
Read-onlyWe only ask how many rows an anonymous visit would see. Nothing is written, nothing is copied.
What it doesn't seeWrites, file storage and RPC functions: Rustine's full audit checks them, once you prove the site is yours.
"Protected" here means: nothing to read today.
Run the full auditA table readable here really is. But an empty table with a rule open to everyone (using (true)) looks protected until its first row, and writes, storage and RPC functions aren't tested here. Rustine's full audit checks all of that.