Comparisons the Supabase Security Advisor
Supabase Security Advisor alternative — what it misses
The Security Advisor is built into the Supabase dashboard. It inspects your running project and reports tables in the public schema without Row Level Security, policies that grant more than they should, and a handful of other database-level misconfigurations. It is free, it is accurate, and every Supabase project should have it looked at. Its boundary is also precise: it reads the database as it exists right now. A migration in your branch, a key in your deployed bundle, and a route handler that never checks who is asking are all outside what a database can see about itself.
Where the Supabase Security Advisor wins
If missing RLS on a live table is genuinely your only concern, use the advisor. It is free, it is good, and paying us $19 a month to tell you the same thing would be a waste of your money. This page is about the other three surfaces, and if none of them apply to you then neither do we.
Side by side
| the Supabase Security Advisor | Sentris | |
|---|---|---|
| Price | ■ yes | — no |
| Tables in public without RLS | ■ yes | ■ yes |
| Policies granting using (true) | ■ yes | ■ yes |
| Reads the running database | ■ yes | — no |
| Sees a migration before it ships | — no | ■ yes |
| Secrets in your deployed client bundle | — no | ■ yes |
| Routes taking an id with no auth check | — no | ■ yes |
| Public storage buckets | ◧ partly | ■ yes |
| Re-checks on a schedule without being opened | — no | ■ yes |
| Emails you when a finding is new | — no | ■ yes |
| Price | Free, included with every Supabase project | Free to scan; $19 / month flat for findings and fixes |
Prices checked 30 July 2026 against each vendor's public pricing page. Check theirs before deciding — ours is on this page.
Choose the Supabase Security Advisor if
- You want a free check and RLS is the whole of what you are worried about.
- Your app is Supabase and nothing else — no separate repository, no deployed frontend of your own.
- You are happy to open the dashboard and look, rather than be told.
Choose Sentris if
- You want the migration caught in the branch, before it reaches the database the advisor reads.
- Your frontend is deployed somewhere and you want to know what its bundle contains.
- You have API route handlers that take an id from the caller.
- You want to be alerted when something new appears, rather than remembering to check.
- You want the fix written out, not a description of the problem.
Questions
Is the Supabase Security Advisor free?
Yes, entirely, on every plan including the free one. It is in the dashboard under Advisors. If you have not looked at it, look at it before you look at anything else — including this.
What does the advisor miss?
Three surfaces, all by design. The migration sitting in your branch that has not been applied yet. The service_role key your deployed JavaScript bundle is serving to every visitor. And a route handler that takes a caller-supplied id and never checks whether that caller is allowed to have it. None of those are visible from inside the database.
Do I need both?
If your project is more than a database — a repository, a deployed frontend, API routes — then the advisor covers one of the four places this goes wrong. Whether the other three are worth $19 a month is a question you can answer with a free scan first.
One number nobody else on this list publishes
False-positive floods are the standing complaint about this whole category, and not one tool in it states its rate. Ours is precision 1.000, recall 1.000 over 24 planted findings in 9 repositories — with the date, the commit, the scoring rules and the command that reproduces it, plus a paragraph on why 9 repositories is a small corpus. Measured 2026-08-03.
Find out in about a minute.
A scan needs no account and no card. You see how many exposures you have before you decide whether any of this comparison matters.
Scan my app