Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Supabase

Cross-site scripting (XSS) in Supabase

highUpdated Oct 12, 2026

The database can store the characters. That is fine.

Fix for Supabase

The database can store the characters. That is fine. The bug is rendering them as HTML. You do not need to strip < on the way in if every view escapes on the way out. Do not reflect a stored error string into an admin page with dangerouslySetInnerHTML either.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.