Supabase
Performance
Cost
Security & compliance
Data API max_rows unbounded or above 10000
Part of the Auth hardening & exposure config check · fix arrives as a guide
What it is
The Data API max_rows setting is unbounded or set above 10,000.
Why it matters
A single unpaginated request can then pull an enormous result set, which is a memory spike on the API layer, a large egress charge, and a convenient bulk-export path for anyone with a valid key.
How to fix it
Set max_rows to a value your largest legitimate page needs — 1,000 suits most applications — and use range headers for pagination beyond it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.