How to Secure Your Supabase App

1. Enable RLS on All Tables

Row Level Security is the foundation of Supabase security. Enable it on every table that contains data.

ALTER TABLE profiles ENABLE ROW LEVEL SECURITY;
ALTER TABLE posts ENABLE ROW LEVEL SECURITY;

2. Write Restrictive Policies

Use the (select auth.uid()) pattern for better performance. Test policies with different user contexts.

CREATE POLICY "Users read own profile" ON profiles
  FOR SELECT TO authenticated
  USING ((select auth.uid()) = id);

3. Protect Service Role Key

The service_role key bypasses RLS. Never expose it in frontend code. Use it only in server-side functions.

4. Secure RPC Functions

Database functions should check authentication. Use SECURITY DEFINER carefully.

CREATE FUNCTION get_user_data()
RETURNS json AS $$
BEGIN
  IF auth.uid() IS NULL THEN
    RAISE EXCEPTION 'Not authenticated';
  END IF;
  -- function logic
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;

5. Configure Auth Settings

Enable email confirmation, set password requirements, and configure rate limiting in the Supabase dashboard.

6. Test Your Policies

Query your database as an anonymous user to verify RLS is working. VAS does this automatically.