Database DR & network
Whether you could recover, and who can connect.
Overview
Reads disaster-recovery and network posture from the Supabase control plane: backup and point-in-time-recovery state, SSL enforcement, network allow-lists, disk headroom, and Postgres version currency.
What it looks for
- Point-in-time recovery disabled
- Backups failing, or none configured
- Disk pressure, or a project already in read-only lockdown
- SSL not enforced on connections
- Network open to 0.0.0.0/0 with no allow-list
- Postgres running an out-of-date major version
Why it matters
Backups are a setting nobody checks until the day it matters, and PITR disabled means your recovery point is whenever the last nightly ran. A database reachable from 0.0.0.0/0 is one credential away from being reachable by anyone.
Rules in this check
| What it reports |
|---|
| Out-of-date Postgres |
| PITR disabled |
| Backups failing/none |
| Disk pressure / read-only lockdown |
| SSL not enforced |
| Network open to 0.0.0.0/0 |
How the fixes arrive
Findings from this check are graded when the scan runs, so the fix path is chosen per finding rather than fixed per rule. Low-risk changes arrive as a pull request you review, changes that need confirming against your live config arrive as a draft, and the rest as a step-by-step guide.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.