Supabase Security Advisor vs Suparbase

Supabase Security Advisor vs Suparbase — what it costs?

Supabase Security Advisor does not state it on supabase.com. The advisors documentation states no price; they are part of the dashboard. Suparbase: Free · Hosted $12 per user/month. “Free $0 forever” covers one solo workspace and “Up to 3 Supabase connections”; “$12 per user / month” adds unlimited connections and Agent Sentry’s continuous scans. Read from supabase.com and suparbase.com on 2026-09-18.

Supabase Security Advisor vs Suparbase — what it needs from you?

Supabase Security Advisor: Access to your Supabase project, through Studio, MCP, the CLI or the Management API. The documentation was rewritten after this row was read on 4 September 2026. It now says "You or an agent can pull the same checks from: Studio: Security Advisor and Performance Advisor. MCP: get_advisors with type set to security or performance. CLI: supabase db advisors. Management API: security advisors and performance advisors." The dashboard is one of four routes rather than the only one. Suparbase: A Supabase URL and an API key. “Paste a Supabase URL + API key”. The key is encrypted at rest and proxied server-side rather than held in the browser. The free Security Scanner is the lighter path — it needs no account. Read from supabase.com and suparbase.com on 2026-09-18.

Supabase Security Advisor vs Suparbase — tests as a signed-in user?

Supabase Security Advisor does not state it on supabase.com. The advisors inspect the project's own configuration; the documentation describes no test of a running app as a signed-in user. Suparbase: No — anonymous probe, plus a simulator. The scanner is explicitly the stranger’s view: “See what a stranger can read from your Supabase project.” Roles are covered separately inside the admin, which can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims. All rolled back.” That is a simulation against your own connection, not a request made by a signed-up account. Read from supabase.com and suparbase.com on 2026-09-18. Tests as a signed-in user here means whether the tool authenticates and probes as a real account, rather than only reading what an anonymous stranger can reach.

When should I pick Supabase Security Advisor, and when Suparbase?

Supabase Security Advisor — You have not run anything yet. It is already inside the dashboard you are logged into, it runs on its own, and it sees things no external scanner can — an unindexed foreign key, a table with RLS disabled, a function with a mutable search path. Run it first, whatever else you do. It reads your project's configuration rather than your shipped app, which is why it is a different check and not a lesser one. Suparbase — You want one tool that both RUNS your Supabase project and watches it, rather than a check you run at launch. Suparbase is the only option in this table that is also a working admin — prod→staging sync, a per-row audit log, inline editing, and a live RLS simulator that can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims”. Its free tier is genuinely free forever for up to 3 connections, and at “$12 per user / month” its Agent Sentry keeps a continuous anon-key probe running, which is the cheapest standing watch here. Its five free tools — a Security Scanner, an RLS generator, a schema visualiser, a type generator and a secret scanner — also need no account at all: “no sign-up, no email wall, and no trial timer.”.

You have not run anything yet. It is already inside the dashboard you are logged into, it runs on its own, and it sees things no external scanner can — an unindexed foreign key, a table with RLS disabled, a function with a mutable search path. Run it first, whatever else you do. It reads your project's configuration rather than your shipped app, which is why it is a different check and not a lesser one.

You want one tool that both RUNS your Supabase project and watches it, rather than a check you run at launch. Suparbase is the only option in this table that is also a working admin — prod→staging sync, a per-row audit log, inline editing, and a live RLS simulator that can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims”. Its free tier is genuinely free forever for up to 3 connections, and at “$12 per user / month” its Agent Sentry keeps a continuous anon-key probe running, which is the cheapest standing watch here. Its five free tools — a Security Scanner, an RLS generator, a schema visualiser, a type generator and a secret scanner — also need no account at all: “no sign-up, no email wall, and no trial timer.”