Who let them in? Ember checks your Supabase sign-ups

Ember takes guest lists seriously. A "private" team app on Supabase may still let any stranger create an account.

Here's why: Supabase Auth allows new user sign-ups by default. If your RLS policies say "any logged-in user can read," a stranger who signs up is now a logged-in user.

The two-minute check

1. Open Supabase, then Authentication, and find the setting that allows new users to sign up.
2. App only for you or your team? Turn sign-ups off and invite people instead. Our guide walks through it.
3. Then scan your own app on SniffPup for other open doors.

Fewer surprise guests, more treats.

Want one 2-minute check like this every morning? Sign up below.

Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.