... readable by logged-out visitors, but the table is owner-only. Solution: a SECURITY DEFINER function that looks up by a random share code and returns only public fields, with a fixed search_path and EXECUTE granted to anon and authenticated. 4. Test as the real roles. I run tests inside a single DO block that sets role anon

... private was readable by anonymous users. Nothing failed anywhere, locally or in prod. The fix was revoking everything and re-granting only what the schema files declare. Before applying it, I replayed every real frontend query against production as anon and as a logged-in user inside BEGIN...ROLLBACK. Now I compare the live grants (information_schema.role_column_grants) against the schema files after setting up any hosted project. Comment from Enio Aguiar(@wwenioaguiar): Agree, and there's a second version ... ... suite runs on SQLite, which has no Postgres triggers or row-level security. Green every time, and it never touched the parts most likely to leak data. Those I check by hand with psql against a real Postgres, as anon

... earlier notes. It exists, for auth endpoints. There's an open issue suggesting the configured value isn't always honored, so I treat it as a floor rather than a setting. RLS as the only actual barrier, since the anon role holds table grants by default. Size and MIME limits per storage bucket. Mine were empty, meaning any file type was accepted. The gap I haven't solved: PostgREST has no native per-IP limit. max-rows and RLS reduce ...

... Auth that only lives in the UI and endpoints that return someone else's record both show up in about five minutes that way. Second, check your Supabase or Firebase rules from the outside using just the public anon key, since that key ships to every visitor anyway. And search the built JS bundle, not only the repo, because client-side env vars end up in there. Rate limits are the one most people skip until a bill arrives ...

... avoid finding out the hard way. Any war stories or checklists appreciated. Comment from Siarhei Hamanovich(@siarheihamanovich): RLS on every table, no exceptions, and every policy keyed on auth.uid(). Never on a user id your frontend sends. Your anon key ships in the browser by design, so a table without RLS is readable by anyone who opens devtools. That's how a batch of Lovable apps leaked last year. My own app isn't on Supabase, but the rule ...

... using an LLM with MCP/plugins to help with policies. It got stuck, then disabled RLS "temporarily." Yeah. Temporarily. There are a ton of vibe-coded apps on Lovable, Base44, etc. on the same stack. Same risk: anon key in the client, policies that look fine until they aren't. So I spent a day on hackymacky. Paste a URL. It checks the client bundle for secrets and probes anon

... tools leave behind. Sharing the pattern in case it saves someone a bad week. 1. Open database (the #1 by far) Supabase with Row-Level Security off, or Firebase rules left wide open. Your frontend ships the public anon key, so if RLS is off, anyone who opens devtools can read/write every table. Fix: turn on RLS and write per-table policies, then test with the anon

... correct. A recent example: I had a security researcher report what looked like a real vulnerability. Turned out the AI-assisted fix from weeks earlier had shipped correctly, but the researcher's finding conflated two different things, the anon key being visible client-side (expected, normal) versus

... changing how people think about this layer. Comment from Satish Pophale(@satish_pophale): We keep it simple with per-environment .env files and a validation script that runs pre-deploy to ensure all required Supabase vars ( SUPABASE_URL , SUPABASE_ANON_KEY , SUPABASE_SERVICE_ROLE_KEY ) are present and non-empty. For production, secrets live in the hosting provider's env config, never in checked-in files. Key rotation is manual but infrequent the validation step catches misses before they ... ... that seems to be working for now is to "mount" a static json file that directly comes from the secrets, and frontend has direct access to it (these are not real "secrets" of course, but supa needs its anon

... Solo builder here, won't say much about the product yet but happy to talk shop on the plumbing. Quick version of what I'd tell my past self: Auth - Supabase, Clerk, Auth0, pick one. An afternoon of setup vs. days of building it badly. I tried the days version first, do not recommend. Permissions - this is the sneaky one. Most people check "can this user see this?" in their app code. Way better to push the rule into ... ... tattoos or mockups) Tech-wise I m using: Flutter for the mobile app Firebase (Firestore + functions) OpenAI + Replicate for image generation (testing multiple models right now like DreamShaper, Flux, Ideogram) Biggest challenge so far has been balancing quality vs

... everyoby thank you so much for helping me out in this launch! Let s use this forum to discuss anything related to anonity and your experience so far! I m looking for ways to make anonity

... thing we wanted to be very clear about with Supaguard.pro : We don t ask for service tokens, API keys, or credentials. Ever. Supaguard only looks at what s already public on the internet . If an endpoint, config, or anon key is accessible without logging in, Supaguard can see it. If it needs authentication or a private token, Supaguard simply ignores it. Why we designed it this way Most real-world breaches don t start with stolen credentials. They start with ...