← Back to Guides

    How to Secure Supabase

    Step-by-step guide to securing your Supabase backend. Master Row Level Security and protect your data.

    Critical: RLS is Required

    Without Row Level Security enabled, anyone with your public anon key can read, modify, or delete ALL data in your database. RLS is not optional - it's the foundation of Supabase security.

    Security Checklist

    1

    Enable Row Level Security (RLS)

    Critical

    Enable RLS on ALL tables - without it, anyone with your anon key can read/write all data.

    2

    Write RLS policies

    Critical

    Create specific policies for SELECT, INSERT, UPDATE, DELETE on each table.

    3

    Test RLS policies

    Critical

    Verify policies work by testing as different user roles.

    4

    Protect service_role key

    Critical

    NEVER expose service_role key in client code - it bypasses all RLS.

    5

    Secure anon key usage

    Critical

    Understand anon key is public - security depends entirely on RLS.

    6

    Configure Auth settings

    Critical

    Set up email verification, password requirements, and session management.

    7

    Review storage policies

    Set bucket policies for Supabase Storage access control.

    8

    Enable SSL connections

    Ensure all database connections use SSL.

    9

    Configure database roles

    Set up appropriate database roles and permissions.

    10

    Review Edge Functions

    Audit Edge Functions for security vulnerabilities.

    11

    Enable audit logging

    Set up logging to track database access.

    12

    Configure rate limiting

    Set up rate limiting on Auth endpoints.

    13

    Review realtime subscriptions

    Ensure realtime channels have proper access control.

    14

    Backup configuration

    Set up point-in-time recovery and backups.

    15

    Run security scan

    Use VibeEval to automatically test RLS policies.

    Related Resources

    Is Supabase Safe?

    In-depth security analysis of Supabase.

    Supabase Security Checklist

    Interactive pre-launch security checklist.

    Test Your RLS Policies Automatically

    VibeEval can automatically test your Supabase RLS policies to find misconfigurations before attackers do.

    Scan Your Supabase App