for Supabase · free & open source

Ship Supabase apps
that don't leak.

Six MIT tools that make RLS the default plus the whole multi-tenant SaaS, already built.

Get the free tools → See pricing →
6 tools live on npm & GitHub · MIT · no signup to start
Finn, the ShipSealed seal that seals your app's leaks
bash
# scaffold a secure Next.js + Supabase app in one command
$ npx supabase-saas-kit new my-app
✓ auth · Row-Level Security · a test that proves tenant isolation

# gate RLS in CI — fails the build if a table ships exposed
$ npx airlock-rls
✗ payments: RLS DISABLED → exit 1 · this migration does not merge
BUILT WITH LOVABLE, BOLT OR V0?

Is your app leaking? Find out in 30 seconds.

Paste your live URL. We check the two things that leak most in Supabase apps — a master key in your JavaScript, and tables anyone can read without logging in. No signup, and your data is never shown.

Who it's for

Built for you if…

  • RLS is on, but no test proves tenants stay apart
  • A migration could ship with RLS off, unnoticed
  • Ownership logic is copy-pasted across tenant tables
  • CI runs your tests, but none check isolation

Not for you if…

  • You're not on Supabase / Postgres RLS
  • You don't use migrations or CI at all
  • Your app is single-user, so there's no tenant to isolate
  • You're shopping for a landing page template, not plumbing

The free tools

Open source, MIT, no signup. Each one makes the safe path the default — across RLS, auth, migrations, and abuse.

FREE · ONLINE service_role key scanner

Paste your app's URL: we read the page and its JavaScript and tell you if the Supabase master key ships to the browser. No signup.

Scan your app → FREE · ONLINE RLS policy generator

Pick who can access a table and get the migration: RLS, one policy per operation, grants and indexes, tested against Postgres.

Generate policies → FREE · ONLINE RLS policy explainer

Paste a policy and get it in plain English, plus a leak check: USING (true), a missing WITH CHECK, or anon with no per-user scope.

Explain a policy → FREE · MIT Supabase rules for your AI

Drop-in rules so Cursor, Claude Code and Windsurf write secure Supabase by default: RLS, scoped policies, explicit grants, no service_role in the browser.

Get the rules → FREE · TEMPLATE nextjs-supabase-starter

Auth + one table with RLS + a test that proves isolation. Clone it and start on your product.

Use this template → FREE · npm supabase-saas-kit

The CLI: scaffold a project, check your env + Supabase connectivity, and generate RLS-safe migrations.

npx supabase-saas-kit new → FREE · npm + Action~150 ↓/mo · Oct 2026 airlock-rls

Stops the classic Supabase leak: a table shipped public. Fails the build when RLS is off or a policy is USING (true). Its paid tier, Airlock Monitor, is below.

npx airlock-rls → FREE · npm airlock-auth

Catches a server secret about to ship in the browser bundle. Fails the build on NEXT_PUBLIC_ secrets; warns on unauthed mutations and unverified webhooks.

npx airlock-auth → FREE · npm airlock-migrate

Catches a migration that quietly turns RLS off in prod. Fails the build on a new table without RLS or RLS switched off; warns when a policy is dropped. No database needed.

npx airlock-migrate → FREE · npm airlock-ratelimit

Drop-in rate limiting that doesn't punish families — keys authenticated requests by user, not shared IP. Token bucket, zero deps, typed.

npm i airlock-ratelimit →
◆ LIVE DEMO · REAL POSTGRES

Watch a cross-tenant leak get blocked

Same database, same tenant, same goal. One policy leaks, one blocks — and you can run the same request as the other tenant to prove the row was there all along.

Run the live demo →

Keep it sealed after launch

Airlock Monitor watches the database once real customers are in it.

● DAILY WATCH · SUBSCRIPTION · YOUR LONG-TERM GUARD

Airlock Monitor

CI checks the migrations you write. Airlock Monitor checks everything else your live database exposes — the surfaces that leak without a migration ever touching them. It re-audits every morning and emails you as soon as a check finds one.

$19.99/mo
Start 14-day free trial → No account needed. Start the trial, we email your login link.
Free for 14 days · cancel before it ends, pay nothing No card? Start on Airlock Free: 1 project, checked weekly →
what it watches
Tables with RLS turned off USING(true) / WITH CHECK(true) Storage buckets left public Realtime tables readable by anon SECURITY DEFINER functions that bypass RLS Views running as owner, ignoring RLS

Findings come ranked CRITICAL → LOW, plus a monthly report of what's still open. Connect Supabase in two clicks (Finn creates a read-only user and discards the authorization, nothing to paste) and the first scan runs right away.

the email it sends 
Subject: Airlock detected 2 NEW RLS exposure(s) in acme-prod

  • invoices — table in "public" has RLS DISABLED — every
    row is exposed to the API roles
  • notes — [SELECT] any authenticated user reads all rows
    (cross-tenant) — USING(true)

These rows are reachable with the anon key. Fix the migration
or add an allow-rule for intentionally-public policies.
Just need one piece?
Kit Auth + RLS
  • login, signup, password reset + update
  • 4 migrations: workspaces, notes, tightened grants, forced RLS
  • 6 test files, incl. rls.test.ts (isolation) and rls.meta.test.ts (every table has a policy)
Get it → $19.99
Test Kit
  • Vitest + Playwright test files, wired and passing
  • Playwright e2e + config; Vitest for units and components
  • the RLS harness: rls.test.ts + rls.meta.test.ts
Get it → $14.99
UI Kit
  • Alert · Avatar · Badge · Button · Card · Collapsible · EmptyState · Input · LegendRow · Modal · Skeleton · Spinner · StatCard · Switch · Tabs
Get it → $4.99
Every piece comes from the same codebase as the boilerplate, tests included. Get all three — $35.97 (COMBO10 applied)