Built-in posture check
Supahound vs Supabase Advisors: schema lints vs per-user traffic detection
Supabase Advisors are Supabase's own lint checks for schema, RLS and configuration. Supabase also publishes a Security monitor agent guide: a prompt you run once a day in your own agent. Supahound reads each project's edge logs every 1–2 minutes on paid plans and flags what each user does. Run the Advisors first; Supahound covers the traffic they do not watch.
Last updated
How do Supahound and Supabase Advisors compare?
| Question | Supahound | Supabase Advisors |
|---|---|---|
| Checks schema and RLS configuration? | Yes. Free daily posture scan that includes Security Advisor findings. | Yes. Security Advisor runs Supabase's own lints. |
| Watches live Supabase traffic? | Yes. Reads edge logs every 1–2 minutes on paid plans. | Health Advisor measures error rates from logs. The monitor agent compares API and Auth failure rates. |
| Per-user detection? | Yes. Detectors run per actor. | Security Advisor does not attribute traffic to users. The agent guide does not describe per-user alerts. |
| How often does it check? | Every 1–2 minutes on paid plans; posture scan daily. | Advisors on demand. The monitor agent once a day. |
| Who runs the alerting? | Supahound hosts it: email and signed webhooks, incidents, 30-day history. | You run the agent in your own harness, which stores alert state. |
| Needs a service-role key? | No. Read-only OAuth. | No. The agent uses read-only MCP. |
What does Supabase Advisors do well?
- Security Advisor runs deterministic lints from Supabase itself: RLS disabled in public, permissive RLS policies, security definer views, exposed auth.users, sensitive columns and anon-executable security definer functions.
- Runs on demand from Studio, the CLI (supabase db advisors), the Management API or the MCP get_advisors tool, with no extra account.
- Health Advisor (added 2026-09-18) measures error rates across Auth, Storage, Edge Functions and the Data APIs from logs.
- The Security monitor agent guide uses read-only MCP (get_advisors and query_logs), runs daily, and reports new or changed advisor findings and Auth and API failure-rate spikes.
What does Supabase Advisors not cover?
- Security Advisor checks schema and configuration. It does not attribute traffic to individual users or flag one user reading other users' rows.
- The Security monitor agent runs once a day and compares API and Auth failure rates across the last two complete UTC days. Supabase calls a spike "a review signal, not proof of an attack".
- You set up and maintain the harness that runs the agent and stores its alert state. There is no hosted incident grouping or incident history.
- The Advisors docs page does not describe a schedule or email alerts for Security Advisor findings.
How much does Supabase Advisors cost?
The Advisors are part of the Supabase dashboard and are not priced separately. Supabase plans start at $0 (Free), $25 per month (Pro) and $599 per month (Team). The Security monitor agent is a prompt you run in your own agent, such as Claude Routines, Codex scheduled tasks or Cursor Automations, so it costs what that agent subscription costs. Supahound's posture scan is free; runtime detection is $29 per project per month (pricing).
Which one should I choose?
Choose Supabase Advisors first, whatever else you pick: every Supabase team should run the Advisors. If you want a free check and will run your own daily agent, that may be enough without paid monitoring.
Choose Supahound if you want per-user detection of cross-tenant reads, service-key misuse, credential stuffing, scraping and database tampering every 1–2 minutes, with hosted alerts and incident history.
Frequently asked questions
- Does Supahound replace the Supabase Security Advisor?
- No. Supahound's free posture scan includes Security Advisor findings next to RLS coverage, views without security_invoker and newly exposed tables. Keep running the Advisors; they come from Supabase itself.
- Is the Supabase Security monitor agent enough to catch an attack?
- It runs once a day and compares API and Auth failure rates across the last two complete UTC days. Supabase itself calls a spike a review signal, not proof of an attack. Supahound checks every 1–2 minutes on paid plans and names the actor behind each finding.
- What does the Health Advisor measure?
- Supabase added the Health Advisor on 2026-09-18. It measures error rates across Auth, Storage, Edge Functions and the Data APIs from logs. It is a health signal, not a set of security detectors.
Find out if someone is abusing your app
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.