PostgreSQL / Supabase security intelligence
DBX reconstructs how your database can actually be reached — across RLS policies, grants, functions, storage, relationships, and tenant boundaries.
Zero credentials • Deterministic engine • Explainable findings
database security
engine
Migrations describe intent. Permissions describe reality. DBX introspects the live security objects — policies, grants, routines, buckets, relationships — and resolves what each identity can reach in practice.
█deterministic findings
attack path
attack path
database x-ray
The scanner decomposes the database into the surfaces an attacker actually traverses, then reports what each one currently permits.
path analysis
A weak policy may look harmless by itself. DBX connects individual weaknesses to determine whether they form a usable path through your database.
posture
43
Database security score
The score is a function of the findings, not an opinion. Every point deducted maps to a specific rule, a specific object, and the evidence that triggered it.
remediation
Each deterministic finding carries a proposed migration tied to the exact object that produced it, with the expected security effect and the compatibility risk stated up front. Nothing is applied to your database for you.
1create policy "documents_select"2on public.customer_documents3for select4to anon, authenticated5using (true);67create function public.get_customer_document(doc uuid)8returns setof customer_documents9language sql10security definer11as $$12 select * from customer_documents13 where id = doc;14$$;1create policy "documents_select"2on public.customer_documents3for select4to authenticated5using (6 tenant_id = (select auth.jwt() ->> 'tenant_id')::uuid7);89create function public.get_customer_document(doc uuid)10returns setof customer_documents11language sql12security invoker13set search_path = public14as $$15 select * from customer_documents16 where id = doc;17$$;zero credentials
Your database
you run the introspection
Read-only introspection
catalog metadata only
Security snapshot
no rows, no data
DBX
snapshot in, findings out
Deterministic analysis
rules over evidence
No database password
No persistent connection
No agent
No production write access
The snapshot contains catalog metadata — schemas, policies, grants, routines, relationships. It never contains your rows. If the snapshot leaked, an attacker would learn what you already publish in your migrations.
Read the methodologyYou vibe coded
the app.
Who audited
the database?
AI can generate PostgreSQL policies in seconds. That doesn't mean those policies actually isolate your customers.
vibe checked
“If you're a vibe coder, keep this in your toolbox. This is a MUST HAVE. I built my whole backend with AI, but DBX found three RLS leaks I never would have seen.”
Alex Rivera
Founding Engineer @ VibeFlow
“The security audit for the rest of us. It's deterministic, fast, and didn't ask for my production password once. Absolute magic.”
Sarah Chen
Fullstack Developer @ NeonPulse
“DBX is a MUST HAVE for any serious Supabase project. We use it before every major deployment to ensure our tenant boundaries are actually solid.”
Jordan Smith
CTO @ Supastack
“Most security tools are too noisy. DBX is quiet until it finds something that actually matters. The attack paths are a game changer for explaining risk to stakeholders.”
Elena Rodriguez
Lead Architect @ DataGrid
“I vibe coded my MVP in a weekend. DBX audited it in 30 seconds. Found a critical bypass in my public RPCs. Probably saved my startup.”
Marcus Thorne
Indie Hacker @ SoloBuild
“Zero data retention and zero credentials? This is how security tools should be built. It introspects the catalog and leaves. Brilliant.”
Lila Vance
DevOps Engineer @ CloudScale
“If you're a vibe coder, keep this in your toolbox. This is a MUST HAVE. I built my whole backend with AI, but DBX found three RLS leaks I never would have seen.”
Alex Rivera
Founding Engineer @ VibeFlow
“The security audit for the rest of us. It's deterministic, fast, and didn't ask for my production password once. Absolute magic.”
Sarah Chen
Fullstack Developer @ NeonPulse
“DBX is a MUST HAVE for any serious Supabase project. We use it before every major deployment to ensure our tenant boundaries are actually solid.”
Jordan Smith
CTO @ Supastack
“Most security tools are too noisy. DBX is quiet until it finds something that actually matters. The attack paths are a game changer for explaining risk to stakeholders.”
Elena Rodriguez
Lead Architect @ DataGrid
“I vibe coded my MVP in a weekend. DBX audited it in 30 seconds. Found a critical bypass in my public RPCs. Probably saved my startup.”
Marcus Thorne
Indie Hacker @ SoloBuild
“Zero data retention and zero credentials? This is how security tools should be built. It introspects the catalog and leaves. Brilliant.”
Lila Vance
DevOps Engineer @ CloudScale
pricing
We don't want to be another monthly SaaS subscription. Scan your database, get the facts, fix your vulnerabilities, and move on.
Your database never reaches our servers.
DBXray analyzes your snapshot locally in your browser. We don't retain your schema, findings, or remediation data.
Save your remediation SQL before closing the tab.
$0
Free Unlimited Introspection
$19 / 5 scan audits
Run a read-only introspection and get an evidence-backed answer in under a minute.