Search
30 results for "supabase"
- Supabase Function Search Path Mutable warning: what it means and how to fix it
Supabase's Security Advisor flags function_search_path_mutable (lint 0011) when a function has no fixed search_path. Pin it with set search_path = '', schema-qualify every name in the body, find every affected function with one SQL query, and rerun the Security Advisor. Matters most for security definer functions.
- How to disable sign-ups in Supabase for a private app (hiding the button isn't enough)
Hiding the sign-up page doesn't stop strangers: your public key can still call Supabase Auth directly. Turn off Allow new users to sign up, invite people instead, keep anonymous sign-ins off, and keep RLS on every table, because any signed-in user gets the authenticated role. Includes a signed-out test.
- How to find exposed Supabase keys on your website (and tell the safe one from the dangerous one)
Find the Supabase keys your live site ships: search its JavaScript for supabase.co, sb_publishable_, sb_secret_ and eyJ, read the role inside a legacy JWT key, then act. A publishable or anon key is meant to be public; a secret or service_role key bypasses RLS and must be replaced now.
- Pre-launch checklists: Supabase, Firebase, Vercel, Expo, Lovable, Bolt
Free, tick-as-you-go pre-launch checklists for Supabase, Firebase, Vercel, Expo / Rork, Lovable and Bolt. Every item links to the platform's own docs, and where SniffPup has a free check for it, to that check. Includes an interactive Supabase checklist.
- Is the Supabase anon key safe to expose? Yes, if RLS and grants are right. Here's how to check
Yes, the Supabase anon key (and the new sb_publishable_ key) is meant to ship in your frontend. It only reaches what Row Level Security and table grants allow. Never expose service_role or sb_secret_ keys. Here's how to check RLS, test signed out, and decide when RLS is enough versus server-only access.
- Supabase permission denied for table (42501) on a new table: the October 30, 2026 grants change and the safe fix
New Supabase table not showing up in the API, or returning 42501 permission denied? From October 30, 2026, new public tables need explicit GRANTs before the Data API can reach them. Add the grants each role needs, keep RLS on with real policies, and check both with SQL and a signed-out request.
- Supabase RLS policy examples: copy-paste policies for common app patterns
Copy-paste Supabase Row Level Security policies for the patterns most apps need: private rows per user, public read with owner-only writes, team access, admin roles, insert-only forms and per-user storage folders, each with a test to prove it works.
- Leaked Supabase service_role or secret key: what to do in the next 10 minutes
Your Supabase sb_secret_ or legacy service_role key ended up in your app's JavaScript, a public .env file or GitHub. It bypasses Row Level Security. Remove it from client code, create a new secret key, switch every server to it, then delete or deactivate the old one, using Supabase's own steps.
- Supabase security scanner: which free tools check what (inside vs outside)
Looking for a Supabase security scanner? Compare the free options by what they can see: Security Advisor inside your database, migration linters and database tests before you deploy, and outside scans of your live site for leaked keys and tables strangers can read.
- Supabase security audit tool: how to audit your Supabase project for free
A step-by-step Supabase security audit with free tools: run Security Advisor (or supabase db advisors), fix the error-level lints, check functions, views, storage and GraphQL exposure, test with your anon key, then check what your live site leaks.
- Supabase RLS checker: check Row Level Security on every table, free
A free Supabase RLS check in two parts: SQL to list tables with RLS off and the policy mistakes (like using (true)) that leave data open, then a signed-out test with your public anon key.
- Free Supabase exposed data checker
Check what your live Supabase app shows strangers: leaked service_role or sb_secret_ keys, public .env files, and which tables an anonymous visitor can read with your public key.
- Free Supabase RLS policy explainer (paste SQL)
Paste your Supabase schema SQL, pg_policies rows or database advisors JSON and get each risky policy explained in plain English with what to change. Runs in your browser; nothing is uploaded.
- Supabase project check
Connect your Supabase project for a free, read-only check of its security settings. You get a score out of 100, and critical issues come with their fix.
- Supabase view bypasses RLS? Fix it with security_invoker (and lock down SECURITY DEFINER functions)
By default a Postgres view reads its tables with the view owner's privileges, so a view in your exposed public schema can return rows your RLS policies hide. On Postgres 15+ set security_invoker = true, or revoke select from anon and authenticated, or move the view out of the API. SQL to find risky views and a signed-out curl test.
- Deep Supabase and Firebase check
Read-only: which tables, collections and buckets a stranger can read. Counts only.
- Combined Supabase report
Advisor + outside scan + deep check + fix prompts in one report.
- Agent Skill for Claude Code and Cursor
Install the SniffPup skill so your AI coding tool can check your own site or Supabase project.
- How to secure a Windsurf app: a pre-launch security checklist (Windsurf is now Devin Desktop)
Built your app in Windsurf (now Devin Desktop)? Keep .env files out of git and away from the agent, keep secret keys out of NEXT_PUBLIC_ and VITE_ variables, turn on Supabase RLS, make sure /.env and /.git aren't public, add security headers, then check what your live site shows a stranger.
- I leaked an API key in my vibe-coded app. What do I do now?
A calm, step-by-step plan for when a Supabase service_role, OpenAI, Stripe or other secret key ends up in your Lovable, Bolt or Cursor app's JavaScript, a public .env file or GitHub: rotate first, check usage, move it server-side, then re-check your live site.
- Vibe-coded app security checklist: 14 checks before you launch
To check if your vibe-coded app is secure, test your live site, your database and your code. This checklist for Lovable, Bolt, Cursor, Replit and v0 apps covers leaked keys, Supabase RLS, storage buckets, API route auth, rate limits, webhook signatures and headers, with a test for each.
- Is my Cursor app secure? A Cursor app security checklist before you launch
Is your Cursor app secure? Not automatically. A Cursor app security checklist: keep .env files away from the agent and out of git, keep secrets out of NEXT_PUBLIC_ and VITE_ variables, check Supabase RLS, review changes before merge, and test what your live Cursor-built site shows a stranger.
- Best free security scanners for vibe-coded apps (2026)
A neutral list of free security checks for Lovable, Bolt, Replit and Supabase apps: the builders' own scans first, then outside scanners including CheckVibe, GetLeaked, LeakPatrol, SafeToShip, SniffPup, Vibe App Scanner and VibePatrol. Facts checked Oct 26, 2026.
- Is my Lovable app secure? How to check it before you launch
Is your Lovable app secure? Not automatically. Check it in three steps: run Lovable's free Quick and Deep scans, test your Supabase data signed out, then scan what your published site shows a stranger.
- Lovable app security scanner (live URL)
Free passive scan of your published Lovable app's live URL: secret keys in JavaScript, public .env and .git files, Supabase key exposure and security headers. Pairs with Lovable's scans.
- Bolt app security scanner for your live site
Free passive scan of your published Bolt.new app: secret keys in VITE_ variables and JavaScript bundles, public .env and .git files, Supabase key exposure and security headers.
- Cursor app security scan: check your live app
Free passive scan of the app you built with Cursor, once it's live: keys in NEXT_PUBLIC_ and VITE_ bundles, public .env and .git files, source maps, open Supabase tables, CORS and headers.
- Replit app security scanner for your live site
Free passive scan of your published Replit app: secret keys in HTML and JavaScript bundles, public .env and .git files, source maps, Supabase or Firebase exposure and security headers.
- Migration safety check
Paste a database migration, or scan a repo, to catch steps that delete or rewrite data before they run. It also flags migrations that run on deploy with no backup first, and the Supabase project check shows whether you have a backup to restore from.
- Guides
Pre-launch checklists for Lovable, Bolt, Cursor, Replit and Supabase.