Argus + Supabase

Supabase security in one mesh

RLS, storage and exposed-key checks across the Supabase projects you ship — without a key in your dashboard.

What Argus sees on Supabase

The specific signals, on this platform

Argus treats every platform with the depth it deserves — these are theSupabase-specific signals the mesh produces.

RLS configuration and exposure

Argus reads row-level security policies and flags tables and views that have RLS disabled, are over-permissive, or are reachable through a public anon key.

Storage bucket posture

Buckets are checked for public exposure, content-type sniffing risk and missing access policies.

Keys and identity surface

The anon key and service-role key paths are watched for leaks across your source, deployments and config — and the identity provider configuration is audited.

Set up in three steps

From zero to a mesh in under five minutes

Create a read token

In Supabase, create a personal-access token with the scopes Argus requests. Paste it into the integration.

Select projects

Pick the Supabase projects to cover. Argus indexes policies, buckets and identity configuration.

Wire response

Optionally let Argus open pull requests on the connected GitHub repo when fixes belong in migration files.

Findings you will see

What ends up in your queue

— Tables without RLS or with over-permissive policies

— Public Storage buckets

— Leaked anon or service-role keys in source or deployments

— Identity-provider misconfigurations

Read further

Topic hubs and audience pages

Cloud & CDN posture

The discipline this connector sits inside, with field notes from the team.

Secret detection

The discipline this connector sits inside, with field notes from the team.

Solo and indie builders

How this connector fits the audience that uses it most.

Pricing

Unlimited targets on every paid tier. AI usage is what is metered.

Supabase FAQ

Questions, answered

Will Argus read my Supabase data?

No. Argus reads schema, policies and configuration. Records are not accessed.

Why is RLS such a focus?

Because Supabase apps with no RLS effectively run their database in the open browser. It is the single most common Supabase incident pattern, and Argus is built around catching it before it ships.

Does it cover edge functions?

Edge function exposure and secret references are audited. Source-level analysis happens via the connected repo.

What if my service-role key is already in production?

Argus flags it the moment a scan runs, with the rotation path written into the finding. Once you rotate, the historic exposure remains in the ledger so you can prove the incident is closed.

How does it compare to running pg_audit?

Different layer. pg_audit is database-side runtime auditing; Argus is configuration-side posture. Use both if you can.

Can it handle many Supabase projects?

Yes. Unlimited on every paid tier. Useful for agencies running client work or startups with environment-per-project.