Supabase is the backbone of many AI-built apps: database, login and storage in one. Convenient — but a handful of settings determine whether your data is truly safe. This is the checklist we use ourselves.
1. Row Level Security is on — for every table
This is by far the most important one. Row Level Security (RLS) determines who may see which rows in your database. If it is off, anyone with your public key can read everything — and that key is public by design.
Check per table whether RLS is enabled and whether there are rules (policies) that fit your app. “Everyone may do everything” is technically a policy, but it is not security.
2. Your service key is visible nowhere
Supabase has two keys: a public one (anon key) that may appear in your website, and a service key that bypasses all security. The second belongs only on your server or in your edge functions.
If the service key sits in your frontend code or in a public GitHub repo, anyone has full access to your database. Rotate the key immediately — even if you think nobody saw it.
Follow the steps for a leaked key if the service key has been public.
3. Storage buckets are not public by accident
Uploads such as profile photos or documents land in storage buckets. A “public” bucket can be viewed by anyone on the internet — fine for logos, disastrous for contracts or ID documents.
Only make buckets public when the content is truly meant for everyone, and otherwise use policies just like on your tables.
4. Login is tightened up
- Limit who may create an account if your app is not meant for everyone.
- Turn on email confirmation, so people cannot register with someone else's address.
- Disable login methods you don't use — every active method is an extra door.
5. Edge functions check who calls them
Edge functions perform actions with elevated rights. If such a function does not check who the caller is, anyone can use it — including actions meant only for logged-in users or administrators.
Prefer it automatic?
This checklist is exactly what VibeShield checks for you automatically. Connect your project and within minutes you see which points are fine and which need attention — with explanations in plain language. For more background, read our Supabase security guide.
Also use the checklist for launching safely.
Frequently asked questions
Is Supabase itself unsafe?
No, the platform is solid. The risks are almost always in the settings of your own project — and those are easy to verify with this checklist.
My AI tool set up Supabase for me. Did that go well?
Sometimes yes, sometimes no. AI tools often enable RLS but forget the policies, or make buckets public by default. Checking is always necessary — manually with this list or automatically with a scan.
How often should I check this?
With every major change to your app. Every new table, bucket or function can introduce a new gap. With continuous scanning that happens by itself.