Supabase RLS & Keys

supabase-rls-keys · v1.0.0 · paid

Focused audit of the Supabase mistakes AI tools make most — row-level security that exists but does not bind the caller, views and functions that bypass it, columns and auth data readable through the API, policies that trust user-editable metadata, and secret keys shipped to the browser.

RLS Coverage

rls-coverage · weight 0.35 · taxon access-control

Supabase RLS is enabled with real policies on every table
ab-002569
critical
Insert and update policies bind row ownership in WITH CHECK
ab-002641
high
Sensitive columns are not readable through the API on publicly readable tables
ab-002642
critical

RLS Bypass Surfaces

rls-bypass-surfaces · weight 0.35 · taxon access-control

Policy Trust Inputs

policy-trust-inputs · weight 0.15 · taxon access-control

RLS policies do not authorize on user-editable user_metadata
ab-002647
critical

Keys

keys · weight 0.15 · taxon cryptography-and-secrets

No service-role or secret keys exposed to the public bundle
ab-002568
critical