Supabase security audit — a real audit, not a scanner.

The vulnerability almost every Supabase app has at some point

Supabase's Row-Level Security is opt-in, not on by default. The most common flaw isn't a missing lock — it's a lock that looks fastened and isn't. The canonical example:

-- Looks correct. Lets ANY logged-in user read EVERY tenant's rows.
CREATE POLICY "users can read" ON documents
  FOR SELECT USING (auth.role() = 'authenticated');

That policy passes a glance, passes most automated checks, and quietly exposes every tenant's data to every logged-in user. Only reading the code — and then testing it — catches it. The same class includes service_role keys on client-reachable paths (which bypass RLS entirely by design), over-fetching API routes, unauthenticated endpoints, and IDOR.

Why a scanner isn't enough

Scanners are good continuous hygiene — keep yours. An audit answers the question a scanner structurally can't: does my app actually leak?

What Harvey checks on a Supabase + Next.js app

Ten modules, equal weight (security and code health). Among much else:

• Multi-tenant isolation — every RLS policy reviewed for semantics, not just enabled/disabled: USING(true), wrong-column predicates, weak WITH CHECK, user-metadata trust, SECURITY DEFINER functions with unguarded writes.
• service_role exposure — anywhere a service key sits on a client-reachable path.
• Live cross-tenant pen-test — we seed two tenants on a local copy of your stack and try to read across the boundary. Proof, not a warning.
• App Router boundaries — server→client data leaks, Server Action auth and validation.
• Data classification — every PII/PHI/PCI column and where it lives.
• Plus performance, duplication, dead code, maintainability, and test quality.

Full methodology → The Audit.

What you get

• A findings report in plain English, ranked by blast radius — written for a founder, not a pentester.
• For each finding: what it is, where it is, why it matters, and how to fix it.
• A coverage ledger: exactly what we checked and what we didn't, with reasons. No silent gaps.
• A re-audit credit: when you ship the fixes, we re-verify the critical findings once at no extra charge, if requested within 30 days of the original audit. Additional re-audits within that window are a paid add-on at 50% of the original audit price.
• Optional investor-ready summary: a buyer-facing document for fundraise or acquisition diligence.

Pricing

No "book a call to hear the price." Priced by codebase size, measured automatically during the free scan:

• Free scan — $0. Source-only, no credentials, same-day. Static findings from every module source alone can run, plus the ten-module coverage ledger, yours to keep.
• Connected audit — from $500. The full review with real verdicts, plus a read of your live database: live RLS, Supabase advisors, PII in production.
• Full audit — from $1,000. Everything in Connected, plus Harvey stands up a copy of your stack and proves findings with a live pen-test, and runs full mutation testing.

Full grid and size bands → Pricing.