Defencecore - Free Supabase Security Scanner

TL;DR

TL;DR: Defencecore offers a free, browser-based Supabase security scanner that checks for unsafe Row Level Security policies, exposed tables, and public Storage buckets — no API key required.

Source and Accuracy Notes

• Project page: defencecore.com
• Free scanner: defencecore.com/scan
• License: Proprietary (free scanner; Pro tier at $29/month)

What Is Defencecore?

Defencecore is an AI-native security operator purpose-built for Supabase backends. It watches platform logs across authentication, API traffic, Postgres, Storage, Realtime, and Edge Functions, then runs detection rules over all of them together.

The free tier is the Supabase Scanner at defencecore.com/scan — a browser-based tool that audits a Supabase project’s access-control configuration without requiring an API key.

The Free Supabase Scanner

The scanner targets three specific Supabase misconfigurations:

1. Row Level Security and policies

Supabase relies on RLS to control row-level access in Postgres. The scanner looks for:

• Tables that have no Row Level Security enabled
• API grants on unprotected tables
• Missing applicable policies
• Policies that allow every row unconditionally

2. Storage bucket exposure

Supabase Storage buckets can be public or private. The scanner identifies buckets whose objects can be served without an authenticated download request — meaning anyone with the URL can access the contents.

3. Read-only Postgres catalogue scan

The scanner inspects Postgres pg_* catalogue metadata and Storage metadata through a server-owned read-only query. It does not select application rows, generate SQL migrations, or write any settings.

How the Scanner Works

The scan uses Supabase’s own OAuth flow, not a raw API key:

1. You enter your email to receive the report.
2. You authorize via Supabase OAuth — Defencecore never sees your credentials.
3. The tool selects your project and runs fixed, read-only catalogue checks.
4. Results appear in the browser and are emailed as a report.

The scanner explicitly states it never asks for a service-role key, database password, personal access token, or SQL from your browser. The scan takes about 30 seconds.

Important: Defencecore advises against scanning projects that contain sensitive or regulated data (health, payment, government ID, children’s data, etc.) even though the scan reads only metadata.

Defencecore Pro — Continuous Monitoring

The free scanner is a one-time audit. Defencecore Pro ($29/month per project, with a 7-day trial) adds continuous log monitoring across all Supabase surface areas: auth, API traffic, Postgres, Storage, Realtime, and Edge Functions.

Pro is read-only by design — it detects, explains findings, and recommends next steps, with no path that could alter your project.

Practical Evaluation Checklist

• Does the scanner require a Supabase API key? No — uses read-only OAuth.
• What data does it read? Only Postgres catalogue metadata and Storage metadata; no application rows.
• What does it check? RLS policies, exposed tables, unconditional policy expressions, and public Storage buckets.
• Can it change my database? No — it is entirely read-only.
• Does it work with a free Supabase plan? Yes.
• How long does a scan take? Approximately 30 seconds.

Security Notes

• The scanner uses Supabase’s own OAuth flow; Defencecore never receives your Supabase credentials.
• All checks are catalogue-level queries against pg_* views — not SELECT against your application tables.
• The tool holds no write path to your Supabase project.

FAQ

Q: Does the scanner need my Supabase service-role key?

A: No. Defencecore uses read-only Supabase OAuth and never asks for a service-role key, database password, personal access token, or SQL from your browser.

Q: What exactly does the RLS checker test?

A: It checks for tables without Row Level Security, exposed API grants on unprotected tables, missing applicable policies, and policies that allow every row unconditionally.

Q: Does the scanner read or change my application data?

A: No. It inspects Postgres catalogue and Storage metadata using a server-owned read-only query. It does not select application rows or write migrations, policies, or settings.

Q: What does Defencecore Pro cost?

A: $29 per month per monitored Supabase project, with a 7-day trial. The free scanner at defencecore.com/scan has no time limit.

Conclusion

If you run a Supabase project, the free scanner at defencecore.com/scan is worth 30 seconds of your time. It surfaces the most common access-control mistakes — missing RLS on tables, overly permissive policies, public Storage buckets — without requiring any credentials beyond OAuth. The Pro tier at $29/month adds continuous monitoring for teams running Supabase in production.