Security for your Supabase app
Supabase exposes your database through an API from minute one. Without proper RLS, or with the wrong key in the frontend, anyone can read your tables. Check the basics before you launch.
Typical risks in Supabase
Tables without RLS
Row Level Security is the main barrier. A new table without RLS is open to read and write from the browser with the public key.
The service_role in the frontend
The service_role key bypasses all security. If it ends up in client JavaScript, it hands over full control of your database.
Open Storage buckets
A public bucket serves any file to whoever has the URL. Private documents belong in buckets protected by policies.
Related checks
Does your Supabase app pass these checks?
Scan it free and get a fix prompt for every issue we find.
Scan my site free