Supabase security checklist
Supabase is the database behind many AI-built apps: Lovable, Bolt and others connect to it from the browser with a public key. That works because Row Level Security, not the key, decides what each visitor may read and change.
Here is what to check in any Supabase project, from security to the limits that surprise people at launch.
Tables anyone can read
RLS must be on, with a policy, for every table the browser can reach.
'Permission denied for table'
RLS on is not enough: the role also needs a grant on the table.
The service role key in your site
It bypasses every rule; it belongs on the server only.
Public storage buckets
A public bucket serves every file to anyone.
Exactly 1,000 rows
The API returns at most 1,000 rows by default; reports quietly stop counting.
A paused project
Free projects pause after a quiet week, taking the app offline.
Backups you have not checked
Know how old your latest backup is, and how to restore it.
Users logged out after an hour
Sessions need refreshing, or sign-ins quietly expire.
Run the free checks
Two of the most common leaks take under a minute to check. No sign-up.