Scan Supabase Row Level Security (RLS) policies
Scans Supabase Row Level Security policies. Focuses on SQL analysis — source code path analysis belongs to /jss-auth and /jss-nextjs.
If $ARGUMENTS is provided, scan only SQL files at that path. Otherwise search these paths in order:
supabase/migrations/*.sqlprisma/migrations/**/*.sqldrizzle/**/*.sql, migrations/**/*.sqlsupabase db dump --schema public. Do not execute automatically.types/supabase.ts, database.types.ts, etc.) exist, use them to identify table names.Aggregate all migration files to determine the final state per table. Do not judge based on individual files.
DDL statements to track:
CREATE TABLE / CREATE TABLE IF NOT EXISTS — table creationDROP TABLE — table deletion (remove from check targets)ALTER TABLE ... ENABLE ROW LEVEL SECURITY — RLS enabledALTER TABLE ... DISABLE ROW LEVEL SECURITY — RLS disabledCREATE POLICY ... ON table — policy addedDROP POLICY ... ON table — policy removedALTER TABLE ... RENAME TO — track table renamesExcluded tables (auto-skip): _prisma_migrations, schema_migrations, __drizzle_migrations
ENABLE ROW LEVEL SECURITY is missing or was followed by DISABLE in the final state.CREATE POLICY (or all policies dropped). All access is blocked — may be intentional, so Warning.FOR ALL + USING (true) → Critical (effectively no RLS)FOR SELECT + USING (true) → Warning (public read may be intentional, e.g., categories, public_posts)FOR INSERT/UPDATE/DELETE + WITH CHECK (true) → Warning (may be intentional for anonymous form submissions)FOR ALL + WITH CHECK (true) → CriticalSECURITY DEFINER bypass the caller's RLS.auth.uid(), auth.role(), etc.).GRANT ALL ON table TO anon — full permissions to anonymous usersGRANT INSERT/UPDATE/DELETE ON table TO anon — write access to anonymous usersGRANT ... TO authenticated is normal — Info.auth.users. This is a Supabase internal table and direct access is not recommended.Follow the common output format in CLAUDE.md. Additionally output an RLS status summary table:
| Table | RLS | Policies | Status |
|--------|-----|----------|-------------------------------|
| users | ON | 3 | OK |
| posts | ON | 0 | Warning: no policies |
| orders | OFF | - | Critical: RLS not enabled |
Follow suppression rules in CLAUDE.md.