Supabase Studio Scored 93. Here's Their next.config.

Supabase Dashboard scored 93 on our Security Headers & Basics audit — an A grade, and the highest score we've seen from a Next.js project in our benchmarks. Most Next.js apps score between 45 and 70 on this audit. Supabase nearly aced it.

The reason isn't complicated. They configured their security headers properly in next.config.js. That's it. No special middleware. No third-party security SDK. Just the headers config that Next.js has supported since version 10 and that almost nobody uses.

The headers that matter

Here's what a production-grade Next.js headers configuration looks like, modeled on what the highest-scoring projects get right:

// next.config.js
const securityHeaders = [
  {
    key: 'Strict-Transport-Security',
    value: 'max-age=63072000; includeSubDomains; preload',
  },
  {
    key: 'X-Frame-Options',
    value: 'SAMEORIGIN',
  },
  {
    key: 'X-Content-Type-Options',
    value: 'nosniff',
  },
  {
    key: 'Referrer-Policy',
    value: 'strict-origin-when-cross-origin',
  },
  {
    key: 'Permissions-Policy',
    value: 'camera=(), microphone=(), geolocation=(), browsing-topics=()',
  },
  {
    key: 'Content-Security-Policy',
    value: "default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'; form-action 'self';",
  },
];

Let's walk through each one.

Header-by-header breakdown

Strict-Transport-Security

max-age=63072000; includeSubDomains; preload

This tells browsers: "Always use HTTPS for this domain. For the next 2 years. Including all subdomains. And add us to the browser's built-in preload list."

The max-age of 63072000 seconds (2 years) is the recommended value for production. Shorter values like 86400 (1 day) are fine for testing but too weak for production — an attacker only needs one HTTP request to intercept traffic.

includeSubDomains is critical if you serve anything on subdomains (API, docs, admin panels). Without it, api.yourdomain.com could still be accessed over HTTP.

preload lets you submit your domain to the HSTS preload list maintained by browsers. Once preloaded, browsers will never make an HTTP request to your domain — not even the first one. This closes the one remaining gap in HSTS where the initial request could be intercepted.

In our audit, this check (security-headers.transport.hsts-enabled) is high severity with a weight of 3.

X-Frame-Options

SAMEORIGIN

Prevents your site from being embedded in an <iframe> on another domain. This blocks clickjacking attacks where an attacker overlays your real UI with a transparent iframe and tricks users into clicking things they didn't intend to.