Auth checked only in the UI in Supabase
criticalUpdated Oct 12, 2026
Prefer the user's JWT and RLS for ordinary reads and writes, so a forgotten server check still hits the database policy. Use the secret key only for work that has already authorized the caller.
Fix for Supabase
Prefer the user's JWT and RLS for ordinary reads and writes, so a forgotten server check still hits the database policy. Use the secret key only for work that has already authorized the caller.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.