Rls Security Check — Security skill for Claude Code

rls-security-check

A Claude Code skill that audits Supabase and Postgres Row Level Security configuration, then writes the exact `CREATE POLICY` statement to fix every gap it finds.

**The problem:** 88% of AI-built Supabase applications had Row Level Security disabled or misconfigured, according to 2026 security research covering 1,645 publicly listed apps. 170 of those had critical failures where any user with the anonymous public key could read or write the entire database. This is not a rare edge case — it is the default output of AI coding tools that take the fastest path to a working demo.

This skill checks for RLS being disabled, `USING (true)` policies that grant universal access while appearing "enabled," missing `WITH CHECK` clauses that allow ownership reassignment on write, service role key exposure in client code, and misclassified table ownership patterns.

---

Install

# Via npx
npx skills add https://github.com/sowadalmughni/rls-security-check

# Via Claude Code marketplace
/plugin marketplace add https://github.com/sowadalmughni/rls-security-check
/plugin install rls-security-check@sowadalmughni

# Manually — personal
mkdir -p ~/.claude/skills
git clone https://github.com/sowadalmughni/rls-security-check ~/.claude/skills/rls-security-check

# Manually — project-level
mkdir -p .claude/skills
git clone https://github.com/sowadalmughni/rls-security-check .claude/skills/rls-security-check

---

Quick Start

**With a live database (most accurate):**

DATABASE_URL="postgres://user:pass@host:port/db" \
  bash .claude/skills/rls-security-check/scripts/check-rls-live.sh

**Without database access (scans migration files):**

bash .claude/skills/rls-security-check/scripts/check-rls-static.sh .

Or invoke via Claude:

*"Audit RLS on this project"* *"Check my Supabase policies"* *"Is this database safe to launch?"* *"Why can users see other people's orders?"*

---

What Gets Checked

| Anti-Pattern | Severit