Supabase
Security & compliance
Cost
Performance
Releases
Auth hardening & exposure config
Project settings that widen the blast radius of a stolen credential.
Overview
Reads your Supabase project configuration through a read-only connection: auth hardening settings, edge-function JWT enforcement, storage exposure, and which API keys are still live. Config only — no customer data is read.
What it looks for
- Leaked-password protection off, MFA not enrolled
- Wildcards in the redirect allow-list, and open self-signup
- Edge functions deployed with JWT verification disabled
- Legacy API keys or HS256 signing still enabled
- Email OTP expiry over an hour, refresh-token reuse windows over 30 seconds, manual account linking left on
- Data API max_rows unbounded, and schemas beyond public exposed through it
Why it matters
These settings are set once during setup and never revisited. An OTP valid for hours is an interception window; an edge function with verify_jwt off is a public endpoint holding service credentials; legacy HS256 keys stay valid long after you rotated away from them.
Rules in this check
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.