Row Level Security disabled on realtime.subscription
realtime.subscription
realtime.subscription is granted to API roles but has no row filtering.
Security posture
Derived deterministically from the latest scan of Acme Production.
Posture Score
0/100
Needs Attention
Bottom 35% of Supabase projects we've scanned.
Scoring Logic
How deductions work
The score starts at 100. For every open actionable finding, points are deducted based on severity. Platform-managed or resolved findings do not impact your score.
- critical-11 pts
- high-4 pts
- medium-2 pts
- low-1 pts
Score Bands
95-100Strong
85-94Good
65-84Fair
40-64Warning
0-39Critical
Category Health
- RLS Security
- 45
- Tenant Isolation
- 65
- Functions
- 94
- Permissions
- 74
- Storage
- 94
- Views
- 94
3
Critical
2
High
5
Medium
1
Low
16
passed checks
highest priority
open findings
- CriticalRow Level Security disabled on realtime.subscriptionrealtime.subscription
- CriticalRow Level Security disabled on net._http_responsenet._http_response
- CriticalPotential cross-tenant access through SECURITY DEFINER functionpublic.get_invoice(uuid)
- HighAnonymous role granted access to public.webhook_endpointspublic.webhook_endpoints
- HighAnonymous role granted access to public.pricing_planspublic.pricing_plans
- MediumPolicy "Users can view profiles" does not constrain rows to a tenantpublic.profiles
Unlock Full Audit (Demo)
Bottom 35% of Supabase projects we've scanned.
Production-Ready Fixes