A release gate for the parts of Supabase apps that are easiest to miss.

StackRX brings repository security, migration integrity, live database checks, and fix generation into one release workflow.

• RLS and database access

  Check exposed public tables, RLS state, policies, anonymous/authenticated grants, privileged functions, and security-advisor evidence.

• Migration drift

  Validate migration filenames and ordering, compare local versions with Supabase's applied migration history, flag missing or extra migrations, and detect common destructive DDL patterns.

• Storage

  Flag public buckets and suspicious browser access patterns where a private bucket has no obvious least-privilege policy.

• Secret exposure

  Detect high-confidence Supabase secret/service credentials, Stripe secrets, AI-provider keys, GitHub tokens, database credentials, private keys, and committed environment files without storing the detected secret value in the finding.

• Application authorization

  Review serverless/API code for unauthenticated mutations, missing ownership checks, wildcard CORS, sensitive logging, open redirects, and expensive endpoints without rate-limit evidence.

• Release coverage

  StackRX reports how much of the eligible repository it analyzed. A truncated scan or unavailable live evidence becomes NEEDS REVIEW, not READY TO DEPLOY.

• Safe fix generation

  Deterministic rules can generate a migration or patch when the remediation is unambiguous. Ambiguous authorization stays a human decision.

• GitHub fix PRs

  Founder and Agency plans can create a review branch and pull request. StackRX never auto-merges it.

• Continuous release checks

  Founder and Agency plans can scan pushes and pull requests. Agency adds scheduled checks and team workflows.