SUPABASE SECURITY · FREE

The 15-point Supabase security checklist

The exact checks we run before an app goes live. Free.

01 / RUN THESE NOW

The first five. If one fails, you have a problem today.

01
RLS enabled on every table in public schema
One forgotten table is an open door. We check the live schema, not the checklist you keep in your head.
02
No policy uses using (true) on tables with user data
A policy that always returns true is the same as having no policy at all. It only looks safe.
03
service_role key never shipped to the browser
This key ignores every security rule. If it's in your bundle, your whole database is effectively public.
04
Storage buckets with private data are not public
Public buckets are guessable and shareable. Private files need signed URLs, not open links.
05
Auth redirect URLs don't point to lovable.app
Preview-domain redirects break sign-in the day you switch to your own domain — and can be abused before that.

02 / THE FULL LIST

06
Anon key insert test
We try to insert rows with just the anon key to prove your policies actually block writes.
07
Rate limiting on edge functions
An unthrottled edge function is an invitation to spam, brute force and surprise bills.
08
Leaked keys in git history
Deleting a file doesn't remove it from history. We scan every commit for live secrets.
09
npm audit criticals
Critical CVEs in your dependencies are the cheapest attack path an attacker can find.
10
CORS wildcard
A wildcard CORS header lets any website read your API's responses using your users' sessions.
11
Exposed .env
One misplaced .env in a public folder or repository hands over every secret you own.
12
Admin routes without role check
Admin pages guarded only by a hidden link are visible to anyone who guesses the URL.
13
Password reset flow
We run a real reset end-to-end and check where the links point and who can trigger them.
14
Backups enabled
If you can't restore, an incident becomes a data-loss event, not just a security one.
15
Logs without PII
Logs are copied, exported and stored forever. They shouldn't contain your users' personal data.

A senior developer runs all 15 checks — plus 40 more — on your real app and sends a written report in 48 hours.