Supabase security checklist
A focused review for founders and developers launching an AI-built app on Supabase.
Protect privileged keys
The anon key is designed for client use with correctly configured policies. The service-role key bypasses Row Level Security and must remain server-only. If a privileged key entered a public bundle or repository, rotate it.
Enable and test Row Level Security
Enable RLS for tables exposed through the API. Test select, insert, update, and delete policies as an anonymous user, an ordinary signed-in user, a second user, and an administrator. Verify ownership using trusted authentication claims—not client-submitted user IDs.
Review authentication and account flows
Set intended redirect URLs, protect privileged routes on the server, avoid revealing whether an email exists, and review session storage, password-reset behavior, email confirmation, and abuse limits.
Check Storage and Edge Functions
Review bucket visibility and object policies separately from database policies. In Edge Functions, validate input, verify authentication and authorization, restrict CORS, keep secrets in environment storage, and avoid returning internal errors.
Verify before production
Use a staging project, backups, realistic user roles, and negative tests. A passing automated check is evidence—not a guarantee. Read Pallos’s scanning methodology and its stated limits.