DBX

DBX is a web-based analyzer for effective access in PostgreSQL and Supabase databases. It suits developers and security teams working on permission-heavy or multi-tenant systems, including projects that generate SQL with AI. Its main value is turning database reachability problems into evidenced attack paths and migration-ready fixes, while its scope stops at the database layer.

Overview

DBX reconstructs how identities can actually reach database objects rather than reviewing grants or policies in isolation. It follows interactions among row-level security, grants, functions, storage, relationships, and tenant boundaries. That makes it a focused choice for teams that need to understand authorization behavior inside PostgreSQL-family databases, especially when several controls combine to produce an unexpected path.

The scanner is agentless and works with cloud databases. Its snapshot workflow requires no database password, persistent connection, agent, or production write access. A dedicated least-privilege role is designed to need CONNECT, schema USAGE, and SELECT on catalog views. Snapshots contain catalog metadata, including schemas, policies, grants, routines, and relationships, but not database rows. Credentials submitted for the workflow are sent to server-side functions over TLS, are not returned to the browser, and are not written to logs or analytics events.

Key features

DBX resolves what each identity can reach in practice by introspecting live security objects. It then joins individual weaknesses into attack paths and reports severity and confidence with evidence. This connected view is more useful than a flat permission inventory when a risk depends on several policies, routines, or relationships interacting.

Every deterministic finding includes a proposed migration tied to the object that created the issue. The proposal states the expected security effect and compatibility risk, and the paid remediation plan adds copy-paste SQL and post-change verification. That gives database owners a concrete repair workflow, although the team must still review, run, and validate migrations.

A deterministic rule engine evaluates introspected facts and a permission graph. A language model is limited to explaining verified findings and drafting remediation for human review, rather than deciding whether an unverified issue exists. DBX supports privilege analysis and lists Supabase, PostgreSQL, Neon, AWS, GCP, Azure, Render, and DigitalOcean among its platform links.

DBX does not assess application code, network controls, or client authorization logic, and it makes no compliance-certification claims. Organizations seeking broad application, infrastructure, or regulatory coverage need additional tools and reviews.

Pricing

Database Scan

The free plan costs free, billed as “Free Unlimited Introspection.” It includes unlimited schema introspection, database topology and score views, finding counts and severity, and local analysis so data never leaves the browser. This is the sensible choice for developers who want recurring visibility into database permissions without remediation deliverables or a paid commitment.

Full Remediation

The paid plan costs $195, paid once at an introductory launch price. It includes five unique scans, exact vulnerability details, complete attack-path graphs, copy-paste SQL remediation, and verification of fixes after remediation. It fits teams preparing to repair a defined set of databases; the five-scan allowance is a meaningful limit for organizations with many environments or frequent reassessments, and the stated price is one-time rather than a subscription.

Platforms

DBX is delivered on the web and is intended for cloud databases as well as PostgreSQL and Supabase deployments. Its listed ecosystem includes Supabase, PostgreSQL, Neon, AWS, GCP, Azure, Render, and DigitalOcean.

Who it's for

Choose DBX if you build PostgreSQL or Supabase applications and need an identity-by-identity view of effective reach, particularly in multi-tenant architectures or AI-generated SQL workflows. The free plan suits exploratory and ongoing introspection; Full Remediation suits teams that need evidence, attack-path diagrams, executable migration guidance, and fix verification.

It is not the right primary tool for application-code review, network segmentation, client-side authorization, or compliance certification. Those concerns require separate assessment.

Pros and cons

• Pro: Connects RLS, grants, functions, storage, relationships, and tenant boundaries into practical attack paths, exposing interaction risks that isolated checks can miss.
• Pro: Free Unlimited Introspection includes topology, scores, severity counts, and browser-local analysis at no cost.
• Pro: Proposed migrations are tied to the responsible object and include security effect and compatibility risk; the paid tier adds SQL and verification.
• Pro: Agentless, read-oriented snapshot design limits operational footprint, with catalog metadata rather than row data.
• Con: Coverage ends at database security; application, network, and client authorization weaknesses remain outside its analysis.
• Con: Full Remediation is limited to five unique scans, so larger estates may outgrow the one-time package.
• Con: No compliance certification claims are made, so regulated programs cannot treat DBX as their certification evidence.

Alternatives

For a broader directory of products, see Database Vulnerability Scanners.

• Defensia Database Security is a better fit when you need Linux, self-hosted, or web deployment and a free monitoring tier capped at one server, 2,000 events per month, and three days of retention.
• Onam Database Security suits cloud-security-posture work across one cloud account and up to 500 resources, with CIS benchmarks and core critical/high rules.
• Oracle Cloud Infrastructure Secret Management is for managing secrets and versions in OCI rather than tracing PostgreSQL authorization paths.
• Qualys External Attack Surface Management is preferable for external asset discovery and attack-surface management, with a 30-day no-cost CSAM/EASM period.
• SQLTriage is a free Windows or self-hosted option with all features and no per-server fees or subscription.
• Free SQL Server Compliance Benchmark Tool fits SQL Server benchmark checking with more than 80 checks and PDF output.
• Omega DB Scanner Standalone is for Windows-based Oracle security scanning on listed 10g through 12c versions.
• Trellix Data Loss Prevention is the alternative when enterprise DLP across endpoints, email, web, networks, and storage is the priority.

Verdict

DBX is a strong choice for PostgreSQL and Supabase teams that need a defensible picture of effective database reach and practical, object-linked remediation. Its free introspection removes a cost barrier, while the one-time Full Remediation plan adds unusually concrete repair output. Look elsewhere when your priority is application or network security, compliance certification, secret management, or broad data-loss prevention rather than database permission analysis.