Supabase Security Checklist

Supabase security checklist for AI-built apps

Supabase is the most popular backend for vibe-coded apps — and missing database rules are the #1 cause of vibe-coding Supabase security incidents. Use this checklist to make sure your Supabase project doesn't leak user data before you launch.

Think of this page as a manual Supabase security checker: work through it table by table. For an automated pass, VibeSafe doubles as a Supabase security audit tool and Supabase RLS checker — paste your code in and it flags missing policies, exposed keys, and open buckets in seconds.

1. Row-Level Security (RLS)

• RLS is enabled on every table that holds user data
• Each table has a policy scoping rows to auth.uid() — users see only their own data
• No table is left "open" with RLS off (the default leaves data readable with the anon key)

2. Keys

• Only the anon / publishable key is used in frontend code
• The service_role key is never shipped to the browser — server-side only
• No keys hardcoded outside environment variables

3. Storage buckets

• Buckets aren't public unless they're meant to be
• Storage policies restrict who can upload, read, and delete

4. Auth & access

• Email confirmation / sign-in configured correctly
• Sensitive actions check the user's identity on the server, not just the client

VibeSafe reads your app's code for the patterns that signal these problems — the service_role key in frontend code, queries that rely on client-side filtering instead of RLS, and hardcoded Supabase URLs and keys — and explains each fix in plain English.

Related guides: