Daryl Shield · for Supabase apps
Lock down your AI-built app without breaking it.
Daryl finds what anyone on the internet can read in your Supabase project, fixes it, checks each fix only removes access, replays your real traffic to show nothing breaks, and gives you a signed receipt.
Daryl Shield is in early access. The free Check isn’t open yet: leave your app’s address and we’ll email you when it is. The Check reads only what a browser downloads: no rows and no table lists until you prove you own the app.
Example
ExposedAnyone on the internet can read your orders table
| Who | Read | Create | Edit | Delete |
|---|---|---|---|---|
| Anyone | Yes | — | — | — |
| Signed-in | Yes | — | — | — |
| Owner | Own rows | Own rows | Own rows | — |
| Service | Own rows | Own rows | Own rows | Own rows |
After the fix: Anyone and Signed-in lose read. Owners keep their own rows.
What might break: 0 of 41,208 requests in the last 14 days would be denied.
How it works
Every fix is proven, replayed and receipted before it counts.
- 01CheckPaste your URL. Daryl reads what a browser downloads and gives you a Leak Score from A to F.
- 02Connect read-onlyVerify you own the app and connect Supabase with read-only access. Nothing changes.
- 03Shadow modeFor 7 days Daryl watches request shapes (no rows, hashed user IDs) to learn what your app really does.
- 04Fix with proofEach fix is written as a policy, checked to only remove access, and replayed against your real traffic.
- 05Apply, watch, receiptApply in one click or as a pull request. Daryl watches error rates, restores the exact prior state if anything breaks, and signs a receipt.
What you get with every fix
What might break
Before anything changes, Daryl replays your recent requests against the old and new rules and shows exactly which would be denied.
Example
- Requests replayed
- 41,208
- Newly denied
- 12
- Where
- /admin page, 3 queries
The proof
A solver checks that the new policy permits a subset of what the old one did. If it can’t prove that, a person decides.
Example
forbid (principal == Role::"anon", action == Action::"select", resource in Table::"orders");Proven: new ⊆ old
The receipt
Each change is signed and added to a public, append-only log. You can verify it yourself, and show a badge if you want.
Example
- Receipt
- rcpt_…7f2c
- Proof
- sha256 …a91e
- Log index
- #<n>
npx @daryl/verify receipt <id>You choose how much Daryl does
Nothing widens access on its own. Ever.
Start in Suggest. Move to Act with undo after 72 hours of replay data, and to Autopilot after 3 approved fixes with no breakage.
| When | Suggest | Act with undo | Autopilot |
|---|---|---|---|
| Proven narrowing, no requests denied | Approval | Auto, 30-day undo | Auto, digest |
| Replay shows denied requests | Approval | Approval | Approval |
| Touches auth, definer functions or service role | Approval | Approval | Approval |
| Proof unknown | Approval | Approval | Approval |
| Widening, deletion, key rotation, billing | Never automatic | Never | Never |
| Restoring the exact prior state after a breach | Automatic | Automatic | Automatic |
Pricing
Priced per app.
Full pricing →Check
Free
Passive scan, Leak Score, share card
Shield
$49per app / month
Continuous inventory, proven fixes, replay, canary and rollback
Autopilot
$149per app / month
Auto-applies proven zero-diff fixes with 30-day undo
Agency
$399per month, 10 apps
Client workspaces and white-label reports
Launch Hardening
$499one time
A person plus Daryl hardens your project in 3 business days
Want it done this week?
Launch Hardening: a person and Daryl harden your Supabase project in 3 business days, with a PDF report, a 30-minute call and 30 days of Shield. $499.