Is RLSProof free to use?

Yes. RLSProof is available as a free online MC NovaTools utility with no required account for the public tool.

Are my files uploaded to a server?

Where this tool supports local file handling, processing runs in your browser so files do not need to leave your device. Review any visible page notes before using regulated or highly sensitive material.

What should I check before using the RLSProof result?

Review the input assumptions, output format, visible errors, file names, and destination requirements before sharing or relying on the result.

Security tool · Supabase authorization

Prove your Supabase data boundaries before release.

Last updated: 2026-06-03

RLSProof builds an ordered migration state and runs deterministic authorization checks across selected SQL and application files. It reports what it found, what it could not prove, and never turns incomplete coverage into a PASS.

Public GitHub repositories only for URL mode Private ZIP / folder scan No GitHub token Local files stay in your browser Coverage stays explicit

Free Quick Scan

Choose a source

Public repository

Scan from GitHub

Enter owner/repo or a normal https://github.com/owner/repo URL. The browser requests selected public files directly from api.github.com; repository contents are not uploaded to a NovaTools server.

URL mode supports public GitHub repositories only. Limits: 18 selected files · 128 KiB/file · 1 MiB total · 5,000 tree entries · 50,000 KiB repository size. Unauthenticated GitHub API rate limits apply.

Private / local source

Scan locally in this browser

Select a repository ZIP or folder. Source files stay in your browser and are never uploaded to MC NovaTools by this scan. RLSProof does not ask for a GitHub personal access token.

Repository ZIP Best option for a private GitHub repository downloaded as ZIP. Repository folder Select the project directory directly when your browser supports folder selection.

Local limits: up to 512 selected source files · 512 KiB/file · 8 MiB analyzed text · 32 MiB ZIP. Unsupported/build/vendor paths are skipped and surfaced as coverage limits when relevant. Environment-file contents are not loaded into findings.

Ready. Choose a public GitHub repository, private ZIP, or local folder.

Coverage boundary

Quick Scan is intentionally incomplete.

The free browser surface runs bounded native static checks only. Private repositories can now be analyzed from a local ZIP or folder without sending their source to NovaTools, but Quick Scan still does not perform live database catalog introspection, full external scanner coverage, dynamic authorization fixtures, or symbolic tenant-isolation proof. A clean bounded result therefore remains incomplete, not PASS.

RLSProof's architecture separates ingestion, ordered migration state, deterministic rules, coverage accounting and release gating so deeper correlation, semantic diff, proof and CI layers can be added without weakening existing findings.

NovaTools security Report a RLSProof issue

Human-reviewed service

Launch Verification

$149 USD one-time

Payment activation pending

Full scanner coverage, reviewed findings, remediation guidance, and a fix → re-test evidence report before launch. Payment checkout is not presented as active until the payment provider has approved and enabled the live flow.

Launch Verification is not a security certification, compliance attestation, penetration test, or guarantee of security.

Contact about Launch Verification Refund Policy Privacy Policy Terms of Service

Why the result stays auditable

RLSProof uses deterministic rules rather than an AI model to decide security findings or release-gate status. Evidence is redacted for common secret formats before it is displayed, high or critical unresolved findings block the gate, and parser uncertainty or skipped coverage remains visible instead of being converted into success.