harvey-qa
Harvey / Free RLS checkerFree tool

Free Supabase RLS checker.

Paste your Supabase project URL and public anon key. This tool asks your project — from your browser, using your public key — which tables that key can read, and whether it can write to them (a non-destructive check that never saves a row). Add two logins and it also tests whether one logged-in user can read or write another's rows. Everything runs in your browser; nothing is sent to Harvey.
Cross-tenant read test (optional) — two logins

Enter two real users from your project, ideally in different tenants/orgs. The tool signs in as each (password sent only to your project's auth endpoint, never to Harvey) and flags any table where both see the same rows — the tenant-isolation leak a source scan can't prove. It also tries a non-destructive write as one user: every write attempt uses a deliberately-invalid payload that the database rejects before saving, so nothing is ever written to your project.

Runs entirely in your browser. Your URL, key, and any logins are sent only to your own Supabase project, never to Harvey. The anon key is public by design — but never paste your service_role key anywhere.

Get the checks this tool can't do.

The free scan reads your source across all ten modules; the Full audit stands up a copy of your stack and proves — live — whether one tenant can read another.

Run the free scan →How tenant data leaks