Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Supabase

CORS wide open in Supabase

highUpdated Oct 12, 2026

Keep using RLS. Do not put the secret key in the browser to "avoid CORS." If you added custom headers on a Next.js proxy in front of Supabase, apply the allowlist to that proxy, not a wildcard.

Fix for Supabase

Keep using RLS. Do not put the secret key in the browser to "avoid CORS." If you added custom headers on a Next.js proxy in front of Supabase, apply the allowlist to that proxy, not a wildcard.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.