Supabase
Security & compliance
No auth check before a Supabase query in a route handler
Part of the Auth & service-role key safety check · fix arrives as a guide
What it is
A route handler issues a Supabase query with no preceding getUser() or JWT validation.
Why it matters
If middleware is misconfigured, skipped, or bypassed, the query runs for an unauthenticated caller. Relying on a check that lives somewhere else means the handler is only as safe as the routing config.
How to fix it
Call supabase.auth.getUser() at the top of the handler and return 401 when it errors or returns no user. Keep the check in the handler even when middleware also performs it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.