Supabase
Security & compliance
Releases
Postgres extension enabled without review
Part of the Migration & schema safety check · fix arrives as a guide
What it is
A migration enables a Postgres extension that has not been reviewed for what it adds to the database.
Why it matters
Extensions can add functions that reach the filesystem or the network from inside the database, and they run with database privileges. Some also install into public, where their functions are callable by whoever can reach that schema.
How to fix it
Confirm the extension is needed and install it into a dedicated schema rather than public. Check what it exposes and revoke execute from anon and authenticated on anything they should not call.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.