Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Supabase

The client sets the price, role, or plan in Supabase

criticalUpdated Oct 12, 2026

A policy with check (auth.uid() = id) still allows the user to set other columns on their own row. Revoke column updates they should not have, or use a trigger that rejects changes to plan and role .

Fix for Supabase

A policy with check (auth.uid() = id) still allows the user to set other columns on their own row. Revoke column updates they should not have, or use a trigger that rejects changes to plan and role. RLS that only checks the owner does not check the price.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.