Skip to content
SPECIFICTION
Get listed

DBX

dbxray.co

Free plan Web
Visit dbxray.co
Spec score 8.9 #2 of 27 in Database Vulnerability Scanners

What it is

DBX is a web-based security analysis tool for PostgreSQL and Supabase databases. It examines how identities can reach database objects through RLS policies, grants, functions, storage, relationships, and tenant boundaries. DBX inspects live security objects and uses a deterministic rule engine and permission graph to evaluate practical access. It groups individual weaknesses into attack paths and reports severity, confidence, and evidence. Each deterministic finding includes a proposed migration linked to the relevant object, with an expected security effect and compatibility risk. The snapshot contains catalog metadata, including schemas, policies, grants, routines, and relationships, but no database rows. DBX says its snapshot workflow requires no database password, persistent connection, agent, or production write access; scanning is designed for a dedicated least-privilege role with catalog permissions. A language model explains verified findings and drafts remediation for human review. DBX does not test application code, network controls, or client authorization logic, and it makes no compliance certification claims. Free unlimited introspection is available; Full Remediation costs $195, paid once.

Spec sheet

What it does
DBX analyzes PostgreSQL and Supabase security metadata to show how database objects can be reached.Read 15 Oct 2026 · dbxray.co
Intended users
DBX is positioned for developers and teams building PostgreSQL or Supabase applications, including multi-tenant systems and AI-generated SQL workflows.Read 30 Sep 2026 · dbxray.co
Support
Security issues can be reported to [email protected] with reproduction steps, and DBX says it will acknowledge receipt and provide investigation updates.Read 30 Sep 2026 · dbxray.co
Access model
DBX states that it requires no database password, persistent connection, agent, or production write access for its snapshot workflow.Read 30 Sep 2026 · dbxray.co
Analysis method
DBX introspects live security objects and resolves what each identity can reach in practice.Read 30 Sep 2026 · dbxray.co
Attack paths
DBX links separate weaknesses into multi-hop attack paths with severity and confidence indicators.Read 15 Oct 2026 · dbxray.co
Credential handling
Submitted database credentials are sent to server-side functions over TLS, are not rendered back to the browser, and are not written to logs or analytics events.Read 30 Sep 2026 · dbxray.co
Credential model
The advertised scan workflow uses a read-only catalog snapshot rather than a persistent database connection or production write access.Read 15 Oct 2026 · dbxray.co
Credential protection
Credentials are sent to server-side functions over TLS, encrypted, and excluded from browser rendering, logs, analytics and AI prompts.Read 15 Oct 2026 · dbxray.co
Data handling
The security snapshot contains catalog metadata such as schemas, policies, grants, routines, and relationships, but never database rows.Read 30 Sep 2026 · dbxray.co
Data scope
Snapshots contain catalog metadata and exclude application rows.Read 15 Oct 2026 · dbxray.co
Detection method
A deterministic rule engine and permission graph determine findings; the language model only explains verified results and drafts remediation.Read 15 Oct 2026 · dbxray.co
Findings
DBX connects individual weaknesses into attack paths and reports severity and confidence with evidence.Read 30 Sep 2026 · dbxray.co
Founder motivation
The interview says DBXray originated from the question of who audited the database behind an otherwise finished application.Read 15 Oct 2026 · signal-tech-news.vercel.app
Independent developer profile
Theodore Ochsen’s profile says he developed DBXray as a PostgreSQL and Supabase database-security analysis platform.Read 15 Oct 2026 · meritpages.com
Independent technical description
The same profile says DBXray examines database structure, RLS, policies, roles, grants, foreign keys and access patterns.Read 15 Oct 2026 · meritpages.com
Independent workflow description
Ochsen’s profile describes a read-only process in which users run an introspection query and provide the resulting snapshot for analysis.Read 15 Oct 2026 · meritpages.com
Limit: compliance
The company says DBX does not certify databases as secure and makes no compliance-certification claims.Read 15 Oct 2026 · dbxray.co
Limit: coverage
DBX does not test application code, network controls or client-side authorization logic.Read 15 Oct 2026 · dbxray.co
Limitations
DBX does not test application code, network controls, or client authorization logic and makes no compliance certification claims.Read 30 Sep 2026 · dbxray.co
Linter claims
The SQL-linter page labels the engine version 4.2.0-stable and claims 99.9% audit accuracy.Read 15 Oct 2026 · dbxray.co
Local processing
The homepage says snapshots, findings and remediation data are analyzed locally in the browser and are not retained.Read 15 Oct 2026 · dbxray.co
Maker attribution
Signal//Tech identifies Theodore Ochsen as founder of DaemonCore Enterprises and lists DBXray among its projects.Read 15 Oct 2026 · signal-tech-news.vercel.app
Maker role
Ochsen’s independent profile lists him as founder and lead software engineer of DaemonCore Enterprises.Read 15 Oct 2026 · meritpages.com
Methodology
A deterministic rule engine evaluates introspected facts and a permission graph, while a language model only explains verified findings and drafts remediation for human review.Read 30 Sep 2026 · dbxray.co
Notable news
A Signal//Tech founder interview published August 20, 2026 discusses DBXray as a response to database-access risks in rapidly built applications.Read 15 Oct 2026 · signal-tech-news.vercel.app
Permissions not required
The scanner does not require application passwords, write or DDL privileges, or application secrets.Read 15 Oct 2026 · dbxray.co
Pricing model
DBX describes its commercial model as pay per audit without subscriptions.Read 15 Oct 2026 · dbxray.co
Project date
The MeritPages profile dates the DBXray software project to August 2026.Read 15 Oct 2026 · meritpages.com
Remediation
Findings include proposed migrations with expected security effects and compatibility risks, but DBX does not apply them automatically.Read 15 Oct 2026 · dbxray.co
Required permissions
The trust page lists CONNECT, schema USAGE and SELECT on catalog views as the required database permissions.Read 15 Oct 2026 · dbxray.co
Retention
Scan facts and findings are retained for the period configured by the plan, and deleting a project removes its history and evidence.Read 15 Oct 2026 · dbxray.co
Scanner permissions
The scanner is designed for a dedicated least-privilege database role requiring CONNECT, schema USAGE, and SELECT on catalog views.Read 30 Sep 2026 · dbxray.co
Schema introspection
The site demonstrates introspection of tables, policies, grants and relationships before producing findings.Read 15 Oct 2026 · dbxray.co
Security score
The product calculates a database security score from findings tied to specific rules, objects and evidence.Read 15 Oct 2026 · dbxray.co
Security surfaces
Its analysis covers RLS policies, grants, routines, storage buckets, relationships and tenant boundaries.Read 15 Oct 2026 · dbxray.co
SQL linter
The browser linter flags patterns such as broad public grants, missing RLS, insecure SECURITY DEFINER functions and USING(true) policies.Read 15 Oct 2026 · dbxray.co
Supported platforms
Platform links on the site include Supabase, PostgreSQL, Neon, AWS, GCP, Azure, Render and DigitalOcean.Read 15 Oct 2026 · dbxray.co
Tenant isolation
DBX states that organization-scoped row-level security separates projects, scans, findings and evidence between customers.Read 15 Oct 2026 · dbxray.co

Plans and prices

Database Scan Free Unlimited schemas · topology and score · finding counts and severity · local browser analysis Read 15 Oct 2026 · dbxray.co
Full Remediation $19, paid once Introductory Launch Price 5 unique scans · exact vulnerability details · attack-path graphs · copy-paste SQL remediation · fix verification Read 15 Oct 2026 · dbxray.co

Every DBX plan and price →

Strong points and limits

Strong points

  • Maps access across policies, grants, functions, and tenant boundaries.
  • Findings include severity, confidence, and evidence.
  • Proposed migrations include effect and compatibility risk.
  • Free plan provides unlimited introspection.

Limits

  • Does not test application code or network controls.
  • Does not assess client authorization logic.
  • Makes no compliance certification claims.
  • Full Remediation costs $195, paid once.

Who it suits

It is aimed at developers and teams building PostgreSQL or Supabase applications, including multi-tenant systems and AI-generated SQL workflows.

Verdict

DBX focuses on database access paths and ties deterministic findings to suggested migrations. Its scope does not extend to application code, network controls, or client-side authorization.

Where Specifiction places it

Alternatives to DBXAll alternatives →