DBX

DBX is a web tool for analyzing security in PostgreSQL and Supabase databases. It maps how identities can reach objects through policies, grants, functions, storage, relationships, and tenant boundaries. Its scanner inspects live security metadata and applies a deterministic rule engine and permission graph to assess practical access. Findings connect weaknesses into attack paths and include severity, confidence, and evidence. Each deterministic finding includes a proposed migration tied to the relevant object, with an expected security effect and compatibility risk. A snapshot contains catalog metadata, such as schemas, policies, grants, routines, and relationships, but no database rows. DBX says the snapshot workflow requires no database password, persistent connection, agent, or production write access; scanning is designed for a dedicated least-privilege role with catalog access. A language model explains verified findings and drafts remediation for human review. The free plan offers unlimited introspection. Full Remediation is listed at $195, paid once and includes five unique scans, vulnerability details, attack path graphs, SQL remediation, and fix verification.

DBX focuses on database-level access paths and pairs findings with proposed remediation for human review. Its stated scope excludes application code, network controls, client authorization, and compliance certification.

DBX is positioned for developers and teams building PostgreSQL or Supabase applications, including multi-tenant systems and AI-generated SQL workflows. It may suit teams seeking database access analysis and remediation guidance.

DBX is a web-based analyzer for PostgreSQL and Supabase access security, built for developers and teams that need to understand effective permissions rather than merely inspect isolated settings. It suits multi-tenant projects and AI-generated SQL workflows especially well. The free tier is useful for broad discovery, while the paid package is aimed at teams ready to work through specific database fixes.

Overview

DBX reconstructs how identities can actually reach a database through interacting security objects. It follows row-level security policies, grants, functions, storage, relationships, and tenant boundaries across PostgreSQL or Supabase, then turns those relationships into an access picture that is easier to reason about than a collection of individual permissions.

The product is deliberately database-focused. It does not evaluate application code, network controls, or client-side authorization logic, and it makes no compliance certification claims. That makes it a focused complement to broader security programs, not a replacement for them.

Key features

Effective-access analysis

DBX introspects live security objects and resolves what each identity can reach in practice. This joined-up approach is valuable when access depends on several layers, such as an RLS policy combined with grants, a function, and a tenant relationship. Teams can see database-level attack paths instead of judging each object in isolation.

Evidence and remediation

Individual weaknesses are connected into attack paths, with severity, confidence, and supporting evidence. For every deterministic finding, DBX proposes a migration tied to the object that produced the problem, states the expected security effect, and identifies compatibility risk. That gives database owners a concrete repair starting point, although a human must review, adapt, and deploy the SQL.

Privacy-conscious, agentless workflow

The security snapshot contains catalog metadata—schemas, policies, grants, routines, and relationships—but not database rows. DBX says the snapshot workflow needs no database password, persistent connection, agent, or production write access. Its scanner is designed for a dedicated least-privilege role with CONNECT, schema USAGE, and SELECT on catalog views. Credentials sent to server-side functions travel over TLS, are not returned to the browser, and are not written to logs or analytics events.

A deterministic rule engine evaluates the introspected facts and permission graph. A language model is restricted to explaining verified findings and drafting remediation for human review, which keeps generated guidance subordinate to the underlying checks rather than letting it invent findings.

Pricing

Database Scan — free

This free plan is billed as “Free Unlimited Introspection.” It allows unlimited schema introspection, database topology and score views, and finding counts with severity. Analysis is local, so data does not leave the browser. It is the right starting point for teams mapping exposure or comparing permission changes, but it does not include the paid plan’s exact vulnerability details, attack-path graphs, SQL remediation, or post-fix verification.

Full Remediation — $195, paid once

The one-time introductory launch price includes five unique scans. It adds exact vulnerability details, complete attack-path graphs, copy-paste SQL remediation, and the ability to verify fixes after remediation. This is the more suitable choice for a team with a defined review cycle and several databases or iterations to work through; the five-scan allowance is a meaningful limit for organizations scanning many environments.

DBX uses a freemium model. Cloud databases and privilege analysis are supported, and scanning is agentless. No recurring renewal term is stated for the one-time package.

Platforms

DBX runs on the web. Its platform links cover Supabase, PostgreSQL, Neon, AWS, GCP, Azure, Render, and DigitalOcean, making it relevant to hosted as well as self-managed cloud deployments built around those database technologies.

Who it's for

Choose DBX if you build PostgreSQL or Supabase applications and need to understand effective access across complex policies, especially in multi-tenant systems. It also fits teams reviewing AI-generated SQL, where permission interactions can be difficult to audit manually. The free plan works for reconnaissance and topology review; the paid plan is for teams that want proposed SQL and fix verification.

Look elsewhere if your primary concern is application authorization, network exposure, endpoint controls, or compliance certification. DBX's database-only scope will leave those questions unanswered.

Pros and cons

• Pro: Reconstructs cross-object access paths instead of presenting disconnected permission alerts.
• Pro: Remediation is tied to the responsible object and includes security effect and compatibility risk.
• Pro: Catalog-only snapshots, least-privilege scanning, and an agentless workflow reduce operational exposure.
• Con: It does not assess application code, network controls, or client authorization, so coverage is narrower than a full security review.
• Con: Full remediation is limited to five unique scans, which may not suit large estates.
• Con: Proposed SQL still requires human validation and deployment.

Alternatives

For a wider scanner comparison, see Database Vulnerability Scanners.

• Onam Database Security is a freemium API, self-hosted, and web option with a forever-free tier covering one cloud account, 500 resources, core critical and high CSPM rules, CIS benchmarks, and 30 days of finding history.
• Oracle Cloud Infrastructure Secret Management is a free API and web service centered on secret storage rather than database attack-path analysis.
• Qualys External Attack Surface Management offers a 30-day no-cost CSAM with EASM trial for teams focused on external asset exposure.
• Defensia Database Security provides a free forever monitor-mode tier for one server, 2,000 events per month, and three days of log retention.
• Free SQL Server Compliance Benchmark Tool is a free Windows utility with more than 80 checks and PDF benchmark output for SQL Server.
• Omega DB Scanner Standalone is a free Windows scanner for Oracle 10g and 11g releases and 12c traditional auditing.
• SQLTriage is a free self-hosted, web, and Windows product with all features and no per-server fees or subscription.
• Trellix Data Loss Prevention targets enterprise protection for endpoints, email, web, networks, and data storage across on-premises or SaaS management.

Verdict

DBX is a strong choice for PostgreSQL and Supabase teams that need defensible, database-level access paths and actionable migration drafts, particularly in multi-tenant systems. Its free introspection tier lowers the barrier to mapping risk, while the one-time Full Remediation plan adds the detail and verification needed for a focused repair effort. Choose a broader security or compliance product instead when application, network, endpoint, or certification coverage matters as much as database permissions.