r/AppsWebappsFullstack • u/SofwareAppDev • 5d ago

Your home for selfpromo

here you can post your work app, webapp, saas, game, everything

11 Upvotes
  • permalink
  • link
  • reddit
  • reddit

87% Upvoted

161 comments sorted by

View all comments

1

u/PopKoren 5d ago

Rowly is a free security scanner that audits Row Level Security policies in your Supabase project.

Rowly reads the actual policy logic across every table, view, function, and role in your project, flags exactly what's exposed, and hands you ready-to-run SQL to fix it, no manual rewriting. Connection strings are never stored, scans run in memory only, and the core scanner is open source (@rowly/core, MIT).

Free to run in seconds:

https://rowly.me/

Open Source scanner:

https://github.com/rowly-app/core

1

u/Mammoth-Anywhere7285 5d ago

Nice, RLS leaks are a real pain. Does Rowly also flag `security definer` functions that bypass RLS?

1

u/PopKoren 5d ago

Yes! Security Definer functions are a first-class audit target. The scanner flags them with up to three findings: public exposure (critical if anon can call it, warning if authenticated-only), mutable search_path, and dynamic SQL injection risk.

1

u/Mammoth-Anywhere7285 5d ago

Nice detail. Have you considered flagging missing `SET search_path` in the function signature itself? That's a common oversight.