Who's calling? Ember checks your Supabase RPC functions

Ember answers the door for everyone. Your database functions shouldn't.

Postgres grants execute on new functions to public, and Supabase exposes public-schema functions at /rest/v1/rpc/. With your public anon key, signed-out visitors can usually call them. If a function is security definer, it runs as its owner and bypasses RLS. Supabase's Security Advisor flags anon-executable definer functions as lint 0028.

The two-minute check

1. Open the Security Advisor and look for lint 0028.
2. Run revoke execute on function public.my_function(uuid) from anon, public; then check auth.uid() inside. Our guide has the SQL.
3. Then scan your own app on SniffPup for other open doors.

Good dogs check who's knocking.

Want one 2-minute check like this every morning? Sign up below.

Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.