supabase-isolate-check

Detect structural data isolation risks in your Supabase / PostgreSQL schema.

supabase-isolate-check is a lightweight, SQL-only diagnostic tool designed to identify common misconfigurations in Row Level Security (RLS) and multi-tenant isolation boundaries.

⚠️ Disclaimer

This tool detects structural misconfigurations. It does not simulate adversarial attacks or verify that isolation actually holds under complex JOIN traversal. For forensic verification, see otobrixai.com.

A "clean" scan does NOT guarantee your data is isolated; it simply means no obvious "low-hanging fruit" vulnerabilities were detected.

Features

• RLS Verification: Detects tables missing RLS or tables with RLS enabled but no policies.
• Permissive Policy Detection: Flags policies that lack common tenant filters (e.g., tenant_id, org_id).
• Public Access Auditing: Identifies tables accessible to anon or authenticated roles without RLS.
• Security Definer Risks: Flags SECURITY DEFINER functions and triggers that could bypass RLS.
• Asymmetric Join Paths: Detects foreign key relationships where isolation logic is inconsistent between related tables.
• View Leak Detection: Identifies views that might bypass underlying table RLS.

How to Run

1. Connect to your Supabase / PostgreSQL database using your preferred client (psql, TablePlus, DBeaver, etc.).
2. Execute the isolate-check.sql script.
3. Review the generated report in the results pane.
4. Summary statistics will be printed to the console as NOTICE messages.

Understanding the Severity

• CRITICAL: Immediate data leak risks (e.g., RLS disabled on public tables).
• HIGH: Potential RLS bypass vectors (e.g., Security Definer functions).
• MEDIUM: Pattern-based risks that require manual verification (e.g., missing tenant filters).
• INFO: Educational findings or architecture patterns noted for review.

Author

Built by Otobrix Labs — Forensic Data Isolation for SaaS.