Network open to 0.0.0.0/0
Part of the Database DR & network check
What it is
The database network restrictions allow connections from 0.0.0.0/0 — any address on the internet.
Why it matters
Your database is directly reachable from anywhere, so the credential is the only control. That places it in the path of every credential-stuffing and scanning campaign on the internet.
How to fix it
Restrict connections to the CIDR ranges your application actually connects from. Where a serverless runtime has no stable egress address, route it through a NAT gateway or static-egress proxy rather than widening the range — Supabase network restrictions apply to every connection route, pooled or direct, so the pooler is not a way around them.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.