memstack-security-rls-checker

🔒 RLS Checker: Auditing Row Level Security...

Audit Supabase Row Level Security policies across all tables in a project.

Activation

When this skill activates, output:

🔒 RLS Checker: Auditing Row Level Security...

Then execute the protocol below.

Context Guard

Context	Status
User asks to check/audit RLS	ACTIVE: full audit
User mentions Supabase security	ACTIVE: full audit
User asks about table permissions	ACTIVE: full audit
User is writing RLS policies	DORMANT, they know what they're doing
Non-Supabase project	DORMANT: not applicable

Protocol

Step 1: Discover Tables

Find all Supabase tables referenced in the project. Search in priority order:

1. Migration files: most authoritative source:

   find . -path "*/migrations/*.sql" -o -path "*/supabase/migrations/*.sql" | head -50
   

   Look for CREATE TABLE statements.

2. Generated types: comprehensive if available:

   types/database.ts, types/supabase.ts, src/types/database.types.ts, database.types.ts
   

   Parse the Tables interface for all table names.

3. Client usage: catches tables missed by above:

   grep -r "\.from(['\"]" --include="*.ts" --include="*.tsx" --include="*.js"
   

   Extract table names from .from('table_name') calls.

4. Storage buckets: separate RLS surface:

   grep -r "storage\.from\|createBucket\|storage-api" --include="*.ts" --include="*.tsx" --include="*.sql"
   

Compile a deduplicated list of all tables and storage buckets.

Step 2: Extract RLS Policies

For each table, find its RLS configuration:

1. Search migration SQL for RLS statements:
   • ALTER TABLE <name> ENABLE ROW LEVEL SECURITY: RLS is on
   • CREATE POLICY statements: extract policy name, operation (SELECT/INSERT/UPDATE/DELETE/ALL), and USING/WITH CHECK expressions
   • ALTER TABLE <name> FORCE ROW LEVEL SECURITY: RLS enforced even for table owners