BREACHPROBE / SUPARBASE
BreachProbe vs Suparbase
One is an external scanner that signs up two accounts to test your row-level security. The other is a Supabase admin with a free anonymous scanner attached. Compared on the six things that decide which one you want.
2 compared· 6 criteria, identical for every column· every competitor figure read off that company's own page· last verified 2026-09-18
These answer two different questions and the table's third and fourth rows are where they part. Suparbase is the better OPERATING tool and it is not close: it is a working admin with prod→staging sync, a per-row audit log and inline editing, its free tier is free forever for up to 3 connections, and at “$12 per user / month” Agent Sentry keeps a continuous anon-key probe running — the cheapest standing watch of any tool we compare. Its free Security Scanner needs no account at all. But read what that scanner tests: “See what a stranger can read from your Supabase project.” That is the anonymous view, and an anonymous request is refused by a correct row-level security policy and by a badly broken one alike. Suparbase does cover roles, through an RLS debugger that can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims. All rolled back.” — a simulation you drive query by query against your own connection, not a request made by a real signed-up account. BreachProbe does the other half: it signs up two accounts against your shipped app and reports the cross-tenant result table by table, free, from one URL, with nothing installed. If you are choosing one, choose on whether you want a surface to work in or an answer about what a second user can read. If you can have both, Suparbase's free tools cost nothing and BreachProbe's scan costs nothing, so the honest answer is to run both today.
| CRITERION | SUPARBASE |  BREACHPROBE |
|---|---|---|
| What it costs | Free · Hosted $12 per user/month“Free $0 forever” covers one solo workspace and “Up to 3 Supabase connections”; “$12 per user / month” adds unlimited connections and Agent Sentry’s continuous scans. | Free scan · $19 report · $39 with monitoringThe scan is free. “$19 one payment, one report”; “$39 one payment, 30 days” adds the nightly re-scan. |
| What it needs from you | A Supabase URL and an API key“Paste a Supabase URL + API key”. The key is encrypted at rest and proxied server-side rather than held in the browser. The free Security Scanner is the lighter path — it needs no account. | One URL“No account · nothing installed · read-only · one URL”. |
| Tests as a signed-in user | No — anonymous probe, plus a simulatorThe scanner is explicitly the stranger’s view: “See what a stranger can read from your Supabase project.” Roles are covered separately inside the admin, which can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims. All rolled back.” That is a simulation against your own connection, not a request made by a signed-up account. | YesIt creates its own accounts rather than asking for yours. |
| Tests one user reading another's rows | Simulated, one role at a timeThe “RLS debugger” sets custom JWT claims and runs a statement as that role, and the write is “All rolled back.” So one user reading another’s rows is something you construct query by query, rather than a result the tool signs up two accounts to produce. | YesThe page lists it as a row a passive scan cannot test: "rows one user can read that belong to another", where a passive scan "cannot test it" and the probe "counts them, table by table". |
| Re-checks after you ship | Yes, on the paid tier“Agent Sentry continuous scans” is a Hosted line item, described on the homepage as a “Continuous anon-key probe” with per-AI-agent session attribution and one-click undo. | Nightly for 30 days, on the $39 tier“a nightly re-scan for 30 days and an email the moment a new critical or high issue appears”. |
| What you get | An admin workspace; the scan is on-screenWhat you buy is a surface you work in — “Row cards, type-aware forms, FK lookups, bulk operations, CSV/JSON in + out, undoable deletes”. The free scanner keeps nothing: “the security scanner is stateless”. | Findings, a cross-tenant table, a written fix"Every finding located, table by table, a written fix per issue." |
Every figure below was read off that company's own page; each source URL and the date it was read are listed at the foot of this page. BreachProbe is one of the 2 compared and is the one publishing this table.
| TESTS AS A SIGNED-IN USER | whether the tool authenticates and probes as a real account, rather than only reading what an anonymous stranger can reach |
|---|---|
| TESTS ONE USER READING ANOTHER'S ROWS | the two-account test. It is the only check that can tell a working row-level security policy from one that is merely present |
Does Suparbase test whether one user can read another user's rows?
Not as a signed-in probe, and this is the difference that matters. Suparbase's free Security Scanner reports “which of your tables an anonymous visitor can read right now” — the stranger's view. Its admin includes an RLS debugger that can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims. All rolled back.”, so you can construct the two-user question one query at a time against your own connection. BreachProbe signs up two real accounts against the shipped app and reports the cross-tenant result table by table without you writing anything. Both are useful; only the second one answers the question by default.
Why does an anonymous scan miss the worst Supabase leak?
Because a broken policy and a correct one look identical to a stranger. Row-level security that is enabled but does not isolate users — a policy checking a column that is always true, or one missing a with-check clause on insert — refuses an anonymous request exactly the way a correct policy does. The leak only appears once a request carries a valid session, because that is when the policy is actually evaluated against a user id. A scan that never signs in therefore returns a clean result on the single most expensive misconfiguration in this category.
What does Suparbase cost?
Its pricing page states “Free $0 forever” for an individual — “Up to 3 Supabase connections”, a solo workspace, an AES-256-GCM credential vault and 30-day audit log retention, with “No credit card. No time limit.” Hosted is “$12 per user / month” and adds unlimited connections, a team workspace, 90-day retention and “Agent Sentry continuous scans”. A Team tier with SSO and single-tenant deployment is quoted on request. Separately, five tools — the Security Scanner, RLS generator, schema visualiser, type generator and secret scanner — are free with “no sign-up, no email wall, and no trial timer.”
What does BreachProbe cost, and do I need an account?
No account, and the scan is free — you paste a URL, nothing is installed, and the read is read-only. A full report is $19 as a one-off payment: where every finding is, the cross-tenant result table by table, and a written fix per issue. $39 buys that same report plus a nightly re-scan for 30 days and an email the moment a new critical or high finding appears. There is no per-seat charge and no subscription on the $19 tier.
Can I use both?
Yes, and it is the cheapest sensible setup. Suparbase's free tier and its five no-account tools cost nothing, and BreachProbe's scan costs nothing, so running both today is free. They overlap very little: Suparbase watches the project you operate — continuously, on the paid tier, via an anon-key probe — while BreachProbe answers what a second signed-up user can reach on the app you shipped. Neither is a substitute for the other, and the failure they respectively catch is different.
BreachProbe is not the right answer to every version of this question, and a comparison page that pretends otherwise is an advert. Each case below is a real one.
You want one tool that both RUNS your Supabase project and watches it, rather than a check you run at launch. Suparbase is the only option in this table that is also a working admin — prod→staging sync, a per-row audit log, inline editing, and a live RLS simulator that can “simulate SELECT/INSERT/UPDATE/DELETE as any role with custom JWT claims”. Its free tier is genuinely free forever for up to 3 connections, and at “$12 per user / month” its Agent Sentry keeps a continuous anon-key probe running, which is the cheapest standing watch here. Its five free tools — a Security Scanner, an RLS generator, a schema visualiser, a type generator and a secret scanner — also need no account at all: “no sign-up, no email wall, and no trial timer.”
Prices and limits move, and a page quoting a stale one is worth less than a page quoting none. Every source is printed here so a reader can check it against the day they are reading this, and a job re-fetches each of these URLs on a schedule and fails when a figure above no longer appears on the page it came from.
| TOOL | SOURCE | GAVE | READ |
|---|---|---|---|
| Suparbase | suparbase.com/pricing | What it costs, Re-checks after you ship | 2026-09-18 |
| Suparbase | suparbase.com | What it needs from you, Tests as a signed-in user, Tests one user reading another's rows, What you get | 2026-09-18 |
| BreachProbe | breachprobe.thecompound.tech/ | What it costs, What it needs from you, Tests as a signed-in user, Tests one user reading another's rows, Re-checks after you ship, What you get | 2026-09-18 |
Last verified 2026-09-18. https://breachprobe.thecompound.tech/vs/suparbase