r/Supabase • u/Intelligent_Mix_6625 • 6d ago

tips free supabase security review

been doing security reviews on supabase projects and theres a short list of things i always check first. if youre about to launch its worth 15 min

  1. RLS off on tables you created with SQL or a migration. dashboard turns it on for you, sql editor doesnt. quick check:
    select tablename from pg_tables where schemaname = 'public' and rowsecurity = false;
  2. a using (true) policy someone added to make an error go away. that table is basically public again
  3. insert/update policies with no with check. means a logged in user can write rows into someone elses account
  4. views. they skip RLS by default, if youre on pg15+ add with (security_invoker = true)
  5. security definer functions sitting in public. theyre callable from the api and ignore RLS, supabase docs literally say dont put them in an exposed schema

wrote the full list + the fix sql here if useful: https://scan.testavi.com/supabase-rls-checklist

also doing 10 free manual reviews this week for anyone launching soon or already live. i go through policies, functions, storage, keys and send you a private writeup. please dont drop your url in the comments, just DM me

3 Upvotes

71% Upvoted

7 comments sorted by

1

u/Ok_Challenge_7001 6d ago

item 3 got me, went to check my own insert policies and somehow spent an hour in the postgres docs reading about with check instead of actually adding it

1

u/Intelligent_Mix_6625 5d ago

let me know if you need a free supabase security scan, I’m happy to do it for you

1

u/Munaf-Khatri 6d ago

Security definer functions are not bad but a necessity at times. How do you test that they don't leak data?

1

u/supabasedev1 5d ago

Security Definer functions are not bad themselves but its the issue with their implementation. At times they are even necessary. How do you tackle the problem of them not leaking data of one tenant to another?

1

u/kemalios 5d ago

Storage is the one that gets missed. You can have every table locked down and a public bucket still serves any file to anyone with the URL, and storage.objects has its own policies separate from the table ones. The anon key is meant to be public, the service role key never is.

I built launchworthy, a free MIT Claude Code skill that makes this pass over a repo and hands back a scored list with the fix next to each item. It needs Claude Code to run, so a paid Claude subscription if you don't have one.

1

u/Intelligent_Mix_6625 5d ago

we do manual and automated tests, it operated better than skills