No ticket, no entry: Ember checks your Supabase Edge Functions

Ember checks every visitor at the door. Your Edge Functions should too.

By default, Supabase Edge Functions require a valid JWT. But AI tools sometimes deploy with --no-verify-jwt or set verify_jwt = false in config.toml to make an error go away. Then anyone who finds the function URL can call it, and if it uses the service role key, it can skip your RLS.

The two-minute check

1. Search your project for verify_jwt and --no-verify-jwt.
2. Keep it off only for webhooks that check their own signature. Our guide shows how.
3. Then scan your own app on SniffPup for other open doors.

No ticket, no treats.

Want one 2-minute check like this every morning? Sign up below.

Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.