In-app WAF and bot protection SDK
Supahound vs Arcjet: blocking in your routes vs detecting in Supabase logs
Arcjet is a security SDK you call in your route handlers for bot detection, rate limiting, WAF rules and signup protection. Supahound reads Supabase edge logs and alerts on abnormal traffic per user. Arcjet blocks requests that pass through your server; Supahound sees the requests that go straight to Supabase.
Last updated
How do Supahound and Arcjet compare?
| Question | Supahound | Arcjet |
|---|---|---|
| Blocks attacks? | No. Detection and alerts only. | Yes. Inline, before the handler runs. |
| Sees direct Supabase API calls? | Yes. It reads Supabase edge logs. | No. Only requests through your routes that call protect(). |
| Detects cross-tenant reads? | Yes, per actor. | No. It does not read Supabase logs. |
| Supabase posture checks? | Yes. Free daily scan. | No. |
| Code changes needed? | No. Connect with OAuth. | Yes. Call the SDK in each route you protect. |
| Entry price | Free posture scan; $29 per project per month for detection. | Free plan: 10,000 requests per month after a 15-day trial. Individual: $25 per month plus usage. |
What does Arcjet do well?
- Blocks bots, rate-limits and applies Shield WAF inline, before the handler runs, with signup protection and email validation.
- SDKs for Next.js, Node.js, Express, Hono, Bun, Deno, SvelteKit, Remix, Astro, FastAPI, Flask and more.
- Also guards AI agents: prompt injection, PII detection and tool-call guards.
What does Arcjet not cover?
- It sees only requests that pass through your own route handlers where you call protect(). The site does not mention Supabase.
- It does not read Supabase logs, so it cannot attribute PostgREST reads to users or detect cross-tenant reads.
- No Supabase posture checks, such as RLS coverage or Security Advisor findings.
How much does Arcjet cost?
Individual is $25 per month (1 member, 1 hour of log retention). Startup is $299 per month (2 members, 24 hours of retention). Enterprise is custom. Usage costs $5 per 1M web requests and $50 per 1M agent requests. After the 15-day trial, the free plan allows 10,000 requests per month with a hard stop. Supahound's posture scan is free; runtime detection is $29 per project per month (pricing).
Which one should I choose?
Choose Arcjet if your traffic goes through your own server routes and you want to block bots and abuse inline, not just get alerts.
Choose Supahound if your front end calls Supabase directly with the anon key, so those reads never touch a route where Arcjet runs.
Frequently asked questions
- Can I use Arcjet and Supahound together?
- Yes. Arcjet blocks abuse on the routes you control. Supahound watches the PostgREST, Auth and Storage calls that go straight to Supabase, where Arcjet is not in the path.
- Why can't Arcjet see a cross-tenant read?
- A Supabase client in the browser sends PostgREST requests to your project's API URL, not to your server. Arcjet runs only where you call protect(), so those reads never reach it.
- Does Supahound block anything?
- No. Supahound detects and alerts, with a plain-English summary and a paste-ready SQL fix. If you need inline blocking on your own routes, Arcjet does that.
Find out if someone is abusing your app
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.