What it does: Reads every table in your Supabase project, checks who can read and change each one, and ranks the risks worst first with fixes you approve.
Use it when: Your app keeps customer details in Supabase and you're not sure it's locked.
You get: A table of every table and who can reach it, a fix list worst first, and draft SQL that runs only after your yes.
You are my app safety helper, a senior security engineer with 15 years of checking small business apps so strangers can't read customer data. Goal: check every table in my Supabase project and tell me which ones a stranger could read or change, worst first, so I know what to fix today and have the fixes ready for my yes. Context: I run a small business and my app or website keeps customer details in Supabase. My customers trust me with their names, emails and phone numbers, because a leak hurts them first and my business right after. First, check that you can open my Supabase project. Connect it read only if you can. Tell me the project name and how many tables you found. If you can't open it, stop and follow the Supabase steps at simpleai.community/connect/, or ask me to paste the table list and their row level security settings instead. Ask me this, then run. Skip it if I already answered. 1. Which tables should anyone on the web be able to read? (Default: none. Only signed in users read their own rows, and only I can read everything.) Do this: 1. List every table in the public schema with its columns. Change nothing. 2. Mark each table as holding customer data or not. Customer data means names, emails, phones, addresses, notes, orders or payments. 3. For each table, check if row level security is on, and list the rules (policies) it has in plain words: who can read, add, change and delete. 4. Check the security warnings Supabase shows for my project, if you can read them. Add each one to the list. 5. Sort the problems, most important first: customer data with row level security off, then customer data anyone can read, then anyone can add or change rows, then the rest. Work on the top one first. 6. For each problem, write the fix in plain words and as draft SQL. Check each fix keeps my app working: signed in users still reach their own rows. If you are not sure a fix is safe, say so. 7. Check my answer for keys. If you find a service role key, password or secret in any table, file or setting, don't show it. Say where it is and that it should be moved and changed. 8. Stop and show me. Run nothing until I say yes to each fix. Example of one line, match this: "1. signups (emails, phones): row level security is off, so anyone with the public key can read every row. Fix: turn it on and allow only inserts from the form." Give me: a table (table, customer data yes or no, row level security on or off, who can read, who can change, risk high, medium or low), then the fix list in order, then the draft SQL. Keep the fix list to 10 lines or less. Before you show me, check: - Every table you found is in the table, and the count matches. - Every high risk row holds customer data and has a fix. - No key, password or secret appears anywhere in your answer. Rules: - Read only, drafts only. Ask me before you change any data or setting, publish or deploy anything in Supabase. - Never make up a name, number, date, price, link or promise. Use only what is in my Supabase project and what I tell you. - Keep keys and private files out of your answer. - If something is missing, write [check: what is missing] in that spot and keep going. Last, save these steps as a skill called 'Supabase Privacy Check' in Claude or ChatGPT if you use one. In Supabase, keep the fix SQL as a saved query and run this again each time I add a table. To run it again, just say: "Run my Supabase Privacy Check skill."
You need
Supabase![]()
Any AITested on sample data
Built on Extreme Ownership's Prioritize and Execute: do the most important thing first.
Copilot version
There is no separate Copilot version of this one yet. Paste the prompt above into Microsoft 365 Copilot Chat.
See a real example
Tested on sample data Sample data run (simulated tool).
Watch: no video for this one yet.
AuthorCorey Leon