How secure are Supabase Edge Functions?

Supabase Edge Functions run on Deno Deploy and are isolated from your database by default. They can access the database using the service_role key, which means any vulnerability in an edge function could lead to unrestricted database access. Edge functions should validate and sanitize all user input, implement proper authentication checks, and avoid exposing sensitive environment variables in responses. By default, edge functions require a valid JWT in the Authorization header unless verify_jwt is set to false. UNPWNED tests your edge function endpoints for common vulnerabilities including missing authentication, input validation issues, and information disclosure.