IS SUPABASE SAFE?

Tables without Row Level Security allow any authenticated or anonymous user to read, write, and delete all data through the public API. This is the most common and critical Supabase misconfiguration.

The service_role key bypasses all RLS policies and grants full database access. If leaked in browser JavaScript, bundle files, or public repositories, attackers gain unrestricted control over your entire database.

Storage buckets that lack access policies allow any user to upload, download, or delete files. Sensitive documents, user uploads, and private assets become publicly accessible.

Database functions exposed via the RPC endpoint without input validation or auth checks can be called directly by anonymous users, potentially allowing data manipulation or privilege escalation.

Without email confirmation enabled, attackers can create accounts with any email address and immediately access authenticated resources. This enables account impersonation and spam registrations.

Is Supabase secure by default?

No. Supabase creates tables with RLS disabled by default, meaning any user with your anon key can read and write all data. You must explicitly enable RLS and write policies for every table before going to production.

What is Row Level Security (RLS)?

RLS is a Postgres feature that lets you define policies controlling which rows each user can select, insert, update, or delete. In Supabase, RLS is the primary mechanism for data protection since the API is publicly accessible.

How do I check if RLS is enabled on my tables?

Go to the Table Editor in your Supabase dashboard and look for the RLS badge on each table. You can also run the SQL query SELECT tablename, rowsecurity FROM pg_tables WHERE schemaname = 'public' to see which tables have RLS enabled.

Is it safe to expose the Supabase anon key in the browser?

Yes, the anon key is designed to be public and works like an API key that identifies your project. It only grants access allowed by your RLS policies. The danger is exposing the service_role key, which bypasses all RLS and grants full database access.

How do I protect Supabase Edge Functions?

Add authentication checks at the start of each function by verifying the JWT from the Authorization header. Validate and sanitize all input parameters, add rate limiting, and use the service_role client only for operations that genuinely need elevated privileges.