Spotlight: FixRLS — a fix kit that refuses to touch your project
Anyone who has shipped a Supabase app has hit at least one of these: an RLS insert error that makes no sense at 1am, a service_role key that somehow ended up in client code, or a nagging feeling that your MCP setup is one misconfiguration away from exposing something it shouldn't. FixRLS is a narrow tool built for exactly that moment. You pick the issue you're seeing (RLS insert error, exposed anon key, service_role key in the wrong place, MCP setup question), swap in your own table and column names, and it hands you copy-paste SQL, an AI repair prompt, key placement guidance, and a proof-of-fix test to confirm the change actually worked.
The interesting decision here is what FixRLS refuses to do. It does not connect to your Supabase project, does not ask for a project URL, and explicitly will not accept a real service_role key, secret key, PAT, or access token if you try to paste one in. No live scanning, no checkout flow pretending to be real yet, no claim of being a security scanner at all. The site says this outright: it's a repair tool, not a scanner, and it makes no claim of complete security. That's a rare bit of restraint for a $19-pitch security-adjacent product, and it's also the whole point. A tool that asks indie developers to hand over their service_role key to "check" their setup is exactly the kind of risk this space should be nervous about. FixRLS sidesteps that trust problem entirely by staying offline and template-driven, at the cost of not being able to actually inspect your project for you.
That tradeoff defines who it's for. If you're a solo founder or small team who just hit a specific, nameable Supabase error (an RLS policy blocking an insert, a key you're not sure is client-safe, confusion about MCP guardrails) and you want a fast, correct starting point rather than a black box, this is a genuinely useful five-minute stop. It's especially good for people who understand SQL well enough to adapt a template but don't want to write RLS policies from scratch under deadline pressure. The free Fix Kit covers one issue at a time, which is honest framing: you're not getting an audit, you're getting a focused patch.
Who should skip it: anyone hoping for an actual scanner that connects to their project, crawls their schema, and flags every RLS gap automatically. FixRLS is explicit that it isn't that, and if what you need is comprehensive coverage across a whole schema, a template generator that only handles one issue per session will feel thin. Teams with complex, multi-tenant RLS setups involving several interacting policies will likely outgrow the one-issue-at-a-time model quickly. And if you're not comfortable validating generated SQL yourself in a non-production project before applying it, the tool's own instructions make clear that step is on you, not on FixRLS.
The $19 Launch Safety Pack is currently a waitlist, not a live product, and the comparison table on the site is upfront about that: it lists expected outputs (broader RLS templates across more risk areas, an exportable handoff bundle, a proof-of-fix checklist) rather than promising them as shipped. That's the right way to frame a pre-launch upsell, but it also means the real test of FixRLS is still ahead. If the paid pack delivers a genuinely wider template library while keeping the same no-secrets, no-connection stance, it could become a small but sticky pre-launch checklist tool for Supabase builders. If it stretches toward being a scanner without saying so, it'll lose the thing that makes it trustworthy right now.
Try FixRLS: fixrls.dev
See the launch: FixRLS on welaunch.sh