PostgreSQL / Supabase security intelligence
DBX reconstructs how your database can actually be reached — across RLS policies, grants, functions, storage, relationships, and tenant boundaries.
Zero credentials • Deterministic engine • Explainable findings
database security
engine
Migrations describe intent. Permissions describe reality. DBX introspects the live security objects — policies, grants, routines, buckets, relationships — and resolves what each identity can reach in practice.
█deterministic findings
attack path
attack path
database x-ray
The scanner decomposes the database into the surfaces an attacker actually traverses, then reports what each one currently permits.
path analysis
A weak policy may look harmless by itself. DBX connects individual weaknesses to determine whether they form a usable path through your database.
posture
43
Database security score
The score is a function of the findings, not an opinion. Every point deducted maps to a specific rule, a specific object, and the evidence that triggered it.
remediation
Each deterministic finding carries a proposed migration tied to the exact object that produced it, with the expected security effect and the compatibility risk stated up front. Nothing is applied to your database for you.
create policy "documents_select" on public.customer_documents for select to anon, authenticated using (true); create function public.get_customer_document(doc uuid) returns setof customer_documents language sql security definer as $$ select * from customer_documents where id = doc; $$;
create policy "documents_select" on public.customer_documents for select to authenticated using ( tenant_id = (select auth.jwt() ->> 'tenant_id')::uuid ); create function public.get_customer_document(doc uuid) returns setof customer_documents language sql security invoker set search_path = public as $$ select * from customer_documents where id = doc; $$;
zero credentials
Your database
you run the introspection
Read-only introspection
catalog metadata only
Security snapshot
no rows, no data
DBX
snapshot in, findings out
Deterministic analysis
rules over evidence
No database password
No persistent connection
No agent
No production write access
The snapshot contains catalog metadata — schemas, policies, grants, routines, relationships. It never contains your rows. If the snapshot leaked, an attacker would learn what you already publish in your migrations.
Read the methodologyYou vibe coded
the app.
Who audited
the database?
AI can generate PostgreSQL policies in seconds. That doesn't mean those policies actually isolate your customers.
pricing
We don't want to be another monthly SaaS subscription. Scan your database, get the facts, fix your vulnerabilities, and move on.
Note: DBX operates entirely in your browser. We have zero data retention. Please save your PDF reports or remediation SQL before closing the tab.
$0
$99 / 5 database scans
Run a read-only introspection and get an evidence-backed answer in under a minute.