Unverified Stripe webhooks in Supabase
criticalUpdated Oct 12, 2026
If the handler writes "this user is paid" with the Supabase secret key, that write bypasses RLS, which is fine only after the signature check has passed. Do not let the browser write plan = 'pro' itself.
Fix for Supabase
If the handler writes "this user is paid" with the Supabase secret key, that write bypasses RLS, which is fine only after the signature check has passed. Do not let the browser write plan = 'pro' itself.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.