Is anyone able to read your Supabase database who shouldn’t?
Locksoup checks in about a minute, using a read-only role. It tells you what it found in plain words and gives you the SQL to fix it.
How it works. Run one SQL snippet to create a login that can only look. Paste its connection string. Get a score, what’s wrong in plain words, and the SQL to fix it.
What it can’t do. It can’t read your rows or change anything. Only schema metadata (table names, policies, function code) goes to the AI model. Fixes are shown, never run.
Why trust it. The engine is open source and measured on a public benchmark: 0.85 F1 on a blind test set, every critical issue caught.