Supabase Release Guard
Know if your app is safe to deploy.
StackRX connects your GitHub repo and Supabase project, checks the code, migrations, RLS, permissions, secrets, and live database configuration, then gives you a clear release verdict and the exact work required to get to green.
Read-only Supabase scanning. Selected GitHub repositories. No automatic database changes.
Release verdict states
READY TO DEPLOY
0 deploy blockers
DO NOT DEPLOY
7 deploy blockers found
NEEDS REVIEW
StackRX needs more evidence before it can safely give you a green light.
The app runs. That isn't the same as ready.
AI made it easy to build the happy path. Production still lives in the edges.
A Lovable, Bolt, Cursor, or Replit build can look finished while the repository and database still contain missing RLS policies, drifted migrations, exposed secrets, public storage, weak grants, placeholder logic, or an endpoint that never checked who owns the record it is changing.
Those problems are hard to see from the UI. StackRX checks the actual code and the actual Supabase project together.
Database security
Find exposed tables, missing RLS, unsafe policies, dangerous grants, public buckets, and privileged functions that deserve another look.
Migration integrity
Compare the migration files in GitHub with Supabase's applied migration history and the live database surface. Catch missing, reordered, destructive, or suspicious migrations before they become production incidents.
Secrets and application risk
Detect high-confidence credentials in source, privileged keys referenced from client code, risky CORS, unauthenticated mutation endpoints, sensitive logging, and unfinished production-path code.
One release check across the repo and the database.
- 1
Connect GitHub
Install the StackRX GitHub App on only the repositories you want to scan. StackRX reads the selected repo. Founder and Agency plans can create a fix branch and pull request only when you ask for it.
- 2
Connect Supabase
Authorize StackRX with read-only Supabase Management API permissions. StackRX does not need your service-role key or database password for normal scanning.
- 3
Run the release scan
StackRX gathers repository, migration, and live Supabase evidence and evaluates it against deterministic release rules.
- 4
Get the verdict
Every full scan ends in READY TO DEPLOY, DO NOT DEPLOY, or NEEDS REVIEW. The gate comes from the rules and available evidence, not from an AI opinion.
- 5
Fix what matters
Open a finding to see what is wrong, why it matters, and the exact remediation. Where the fix can be generated safely, StackRX can produce the migration or patch. Founder and Agency plans can open it as a GitHub pull request for review.
What a finding looks like
Every finding names the rule severity, whether it blocks the release, why it matters, and the remediation.
customers can be read without tenant isolation
Row Level Security is disabled on an exposed table. A caller with Data API access may be able to read rows outside the application's intended tenant boundary.
- Why it matters
- A working UI does not protect the database API. Authorization has to exist at the data layer too.
- Remediation
- Enable RLS, then add and test policies that match the application's real ownership model.
StackRX will not guess what "my row" means in your application just to produce a green check.
Not another generic vulnerability dashboard.
Built around Supabase release reality
StackRX understands migrations, RLS, policies, Supabase Storage, Management API evidence, and the difference between the repo you think you are deploying and the database that is actually running.
A release decision, not a warning pile
Findings are useful. The harder question is whether you should ship. StackRX separates deploy blockers from follow-up work and refuses to issue a green verdict when required evidence is missing.
Fixes you can review
Safe deterministic fixes become migrations or code patches. They go through GitHub review instead of silently changing your customer's production database.
Built for founders, not only database teams
The finding explains the consequence in plain language: what is exposed, what can break, and what to do next.
Built for the person who built the app and now has to trust it.
- AI-assisted SaaS founders
- Indie hackers
- Full-stack developers
- Small product teams
- Agencies managing Supabase client apps
Start with one project. Add automation when you need it.
Free
$0
1 project · 3 basic manual scans/month
Builder
$19/month
3 projects · deep migration/RLS analysis · safe fix generation · AI explanations
Founder
$49/month
10 projects · GitHub/PR scans · fix PRs · deployment gate
Agency
$149/month
50 projects · team members · schedules · white-label reports · Slack/email alerts
A security scanner should not become the new security problem.
StackRX is designed around least privilege. Supabase scanning uses read-only authorization. GitHub access is limited to repositories you select. Short-lived installation tokens are generated server-side. OAuth credentials are encrypted at rest. StackRX never needs a customer service-role key for normal scanning and never auto-applies a database migration.
- Read-only Supabase scanner permissions
- Selected-repository GitHub App installation
- Encrypted OAuth credentials
- Short-lived GitHub installation tokens
- No raw customer source in analytics
- No automatic database writes
- No auto-merge for fix PRs