Supabase fixes
21 guides include a Supabase section. This page only lists those sections. It is not a copy of the full catalog, and a sponsor does not change which guides appear or their order.
- criticalUpdated Oct 12, 2026
Auth checked only in the UI in Supabase
Prefer the user's JWT and RLS for ordinary reads and writes, so a forgotten server check still hits the database policy. Use the secret key only for work that has already authorized the caller.
- criticalUpdated Oct 12, 2026
Exposed .env files and debug endpoints in Supabase
The project URL and publishable key are not secret. The secret key, database password, and service role JWT are.
- criticalUpdated Oct 12, 2026
Firebase rules left open in Supabase
This bug is the Firestore version of missing RLS. If you use Supabase instead, follow tables without row level security.
- criticalUpdated Oct 12, 2026
IDOR: reading or changing someone else's data in Supabase
- criticalUpdated Oct 12, 2026
Keys committed to GitHub in Supabase
Create a new secret key, switch the server to it, then revoke the leaked key and the legacy service role key if that was what got committed. Supabase's rotation note says to fix the cause before you rotate, and to confirm every component uses the new key before you retire the old one.
- criticalUpdated Oct 12, 2026
No cap on LLM API spend in Supabase
A usage table with RLS so users can read their own count and cannot update it is a reasonable store. The server, using a checked session, writes the count.
- criticalUpdated Oct 12, 2026
Open storage buckets in Supabase
Make the bucket private. Add policies so authenticated users can only read and write a prefix that includes their user id.
- criticalUpdated Oct 12, 2026
Secret keys shipped in the frontend in Supabase
Keep two variables, matching Supabase's own example:
- criticalUpdated Oct 12, 2026
Server Actions with no auth check in Supabase
Inside the action, create the client from the user's cookies so RLS runs, or use the secret key only after the session check and add user id to the query yourself. Do not create a module-level secret client and call it from every action by habit.
- criticalUpdated Oct 12, 2026
Supabase tables without row level security in Supabase
Enable RLS, then add a policy that matches the real rule, usually "a signed-in user may access their own rows."
- criticalUpdated Oct 12, 2026
The client sets the price, role, or plan in Supabase
A policy with check (auth.uid() = id) still allows the user to set other columns on their own row. Revoke column updates they should not have, or use a trigger that rejects changes to plan and role .
- criticalUpdated Oct 12, 2026
Unverified Stripe webhooks in Supabase
If the handler writes "this user is paid" with the Supabase secret key, that write bypasses RLS, which is fine only after the signature check has passed. Do not let the browser write plan = 'pro' itself.
- highUpdated Oct 12, 2026
CORS wide open in Supabase
Keep using RLS. Do not put the secret key in the browser to "avoid CORS." If you added custom headers on a Next.js proxy in front of Supabase, apply the allowlist to that proxy, not a wildcard.
- highUpdated Oct 12, 2026
Cross-site scripting (XSS) in Supabase
The database can store the characters. That is fine.
- highUpdated Oct 12, 2026
No rate limiting on auth or paid API routes in Supabase
Supabase Auth has its own rate limits on auth endpoints. Those limits are not a promise about routes you wrote yourself.
- highUpdated Oct 12, 2026
Prompt injection in LLM features in Supabase
If a retrieval step loads rows for the prompt, load them with the user's session and RLS, not with the secret key and a filter the model chose. Otherwise the model is asking your admin client for whatever table it names.
- highUpdated Oct 12, 2026
SQL injection in Supabase
Keep filters in the client methods that take a value separately from the column name. Do not pass user text as a fragment of an .or() filter string.
- highUpdated Oct 12, 2026
Unsafe file uploads in Supabase
Use a private bucket and storage policies that mirror table RLS: a user can upload and read objects under their own prefix. Reject other prefixes in the policy.
- highUpdated Oct 12, 2026
Weak password reset in Supabase
Use Supabase Auth's reset email from the client or server, with a redirectTo URL on an allowlist you configured in the Auth settings. The redirect page should exchange the token through the Supabase client session flow, then call the password update on that session.
- mediumUpdated Oct 13, 2026
Missing privacy policy and terms in Supabase
If Auth stores emails and Postgres stores user rows, say that Supabase is the processor for that data. A delete account action should delete the Auth user and the rows, or document what you retain and why.
- mediumUpdated Oct 12, 2026
Outdated dependencies in Supabase
The Supabase client libraries are normal dependencies. Update them the same way.
How an entry gets onto a platform page is described in the editorial standards.