DBX

DBX is a web-based analyzer for PostgreSQL and Supabase security configurations. It suits developers and teams managing complex permissions, especially multi-tenant databases or AI-generated SQL, who need a path from a database weakness to a proposed fix. The free tier is useful for broad introspection, while the paid tier is aimed at teams that need detailed attack paths and remediation material.

Overview

DBX reconstructs effective database reach rather than merely displaying individual grants or policies. It evaluates how identities can move through row-level security, functions, storage, relationships, tenant boundaries, and other PostgreSQL or Supabase objects. That focus makes it a strong choice when access depends on several interacting controls and a conventional object-by-object review could miss the combined effect.

Its scope is deliberately database-centric. DBX does not assess application code, network controls, or client-side authorization logic, and it makes no compliance-certification claims. Teams seeking a complete application and infrastructure security program therefore need additional tools.

Key features

The scanner introspects live security objects and resolves what each identity can actually reach. It then joins related weaknesses into attack paths and reports severity and confidence with supporting evidence. This relationship-based output is more useful for prioritization than a flat list of permissions, particularly in systems with multiple tenants or indirect access through routines and storage.

Every deterministic finding can include a proposed migration linked to the object that caused it. The recommendation states the expected security effect and compatibility risk, giving database owners a concrete starting point while preserving human review before deployment. A deterministic rule engine and permission graph perform the evaluation; a language model is restricted to explaining verified findings and drafting remediation, rather than deciding whether a vulnerability exists.

DBX's snapshot contains catalog metadata such as schemas, policies, grants, routines, and relationships, but not database rows. The workflow is described as agentless: no persistent connection, database password, agent, or production write access is required for the snapshot. A dedicated least-privilege role needs CONNECT, schema USAGE, and SELECT on catalog views. Credentials submitted for scanning are sent to server-side functions over TLS, are not returned to the browser, and are not written to logs or analytics events.

Pricing

Database Scan

The free plan costs nothing and is billed as Free Unlimited Introspection. It allows unlimited schema introspection, database topology and score views, and finding counts with severity. Analysis is local, so data never leaves the browser. This is a sensible starting point for developers who need recurring visibility across schemas, but it does not include the paid plan's exact vulnerability detail, attack-path graphs, remediation SQL, or fix verification.

Full Remediation

Full Remediation costs $195, paid once at the Introductory Launch Price. It includes five unique scans, exact vulnerability details, complete attack-path graphs, copy-paste SQL remediation, and the ability to verify fixes after remediation. The one-time structure fits a project or review cycle better than an ongoing subscription, while the five-scan allowance may be limiting for teams that expect to assess many databases or repeat scans frequently.

Platforms

DBX runs on the web and supports cloud databases. Its platform links include Supabase, PostgreSQL, Neon, AWS, GCP, Azure, Render, and DigitalOcean. That combination is practical for teams operating PostgreSQL-compatible services across different cloud providers, although the product remains focused on database access rather than provider-wide controls.

Who it's for

Choose DBX if you build PostgreSQL or Supabase applications and need to understand effective privilege across RLS, grants, routines, storage, and tenant boundaries. It is particularly relevant to multi-tenant teams and workflows that generate SQL with AI, where unintended permission paths can be difficult to spot manually. It is less suitable as a standalone choice for application penetration testing, network review, client authorization testing, or compliance certification.

Pros and cons

Pros

• Effective-access analysis: Resolving what identities can reach across interacting objects exposes risks that isolated grant reviews can miss.
• Attack-path context: Linking weaknesses and supplying severity, confidence, and evidence helps teams prioritize consequential paths.
• Actionable remediation: Object-specific migrations include security impact and compatibility risk, with copy-paste SQL in the paid plan.
• Least-privilege, agentless workflow: Catalog-only snapshots and stated avoidance of persistent connections, agents, and production writes reduce operational exposure.
• Generous free introspection: Unlimited schema introspection and local analysis provide meaningful visibility without a subscription.

Cons

• Narrow scope: Application code, network controls, and client authorization are outside the product, so it cannot serve as a complete security assessment.
• Paid scan cap: Full Remediation includes five unique scans, which may not suit large or continuously changing estates.
• Human deployment remains necessary: Proposed migrations require review and application by the team, especially where compatibility risk is material.

Alternatives

Database Vulnerability Scanners is the broader category to compare when you want options beyond DBX's PostgreSQL- and Supabase-focused approach.

Defensia Database Security is a better fit for Linux, self-hosted, or web deployments needing one monitored server, 2,000 events per month, and three days of retention on its free tier.

Qualys External Attack Surface Management suits teams seeking external asset-surface coverage, with a 30-day CSAM and EASM trial rather than DBX's database-path analysis.

Onam Database Security is preferable for cloud-account posture management, offering a free tier for one cloud account, up to 500 resources, and core critical/high CSPM rules.

Oracle Cloud Infrastructure Secret Management is the relevant choice when the requirement is tenancy-based secret storage and version management.

SQLTriage fits readers wanting a free, self-hosted or Windows tool with all features and no per-server fees or subscription.

Free SQL Server Compliance Benchmark Tool is aimed at SQL Server benchmarking, with more than 80 checks and PDF output.

Omega DB Scanner Standalone is a free Windows application for Oracle database scanning across listed 10g, 11g, and 12c versions.

Trellix Data Loss Prevention is the alternative for enterprise DLP spanning endpoints, email, web, networks, and storage.

Verdict

DBX is recommended for PostgreSQL and Supabase teams that need a defensible picture of effective permissions and a direct route to database-level remediation. Its strongest advantage is connecting verified access weaknesses to attack paths and object-specific migration proposals. Look elsewhere if your priority is application, network, client, compliance, or broad data-loss protection coverage, or if five paid scans cannot accommodate your review program.