Supabase 46 rules 9 checks

Supabase security checks

RLS that is actually enforced, schemas that stay private, edge functions that check their callers. These are the rules lumioguard runs against a live Supabase project — connected read-only, rechecked on every scan.

Supabase 5 rules

Auth & service-role key safety

The key that bypasses RLS, and everywhere it reaches.

Security & compliance Open
Supabase 7 rules

Auth hardening & exposure config

Project settings that widen the blast radius of a stolen credential.

Security & complianceCostPerformance Open
Supabase 6 rules

Database DR & network

Whether you could recover, and who can connect.

ReleasesSecurity & complianceStability Open
Supabase 5 rules

Migration & schema safety

The migration that locks the table or loses the column.

ReleasesSecurity & complianceStability Open
Supabase 5 rules

Performance advisors

Supabase’s own lints, tied back to the code that triggers them.

CostPerformanceStability Open
Supabase 5 rules

Realtime & cost

Subscriptions and queries that bill by the row.

CostPerformanceStability Open
Supabase 3 rules

RLS & tenant isolation

Tables any logged-in user can read end to end.

Security & complianceStability Open
Supabase 5 rules

Runtime error logs

What is actually failing in production right now.

StabilityPerformanceCode quality Open
Supabase 5 rules

Storage safety

Buckets and object URLs that are more public than intended.

Security & complianceCost Open
GuideSupabase RLS, explained properly — the full guide →

Every Supabase rule

Auth & service-role key safety

5 rules
Service-role key exposed in client-side code — full RLS bypass SupabaseAuth & service-role key safety Service-role client queries a table with no tenant filter SupabaseAuth & service-role key safety Anon-key client used for a privileged write SupabaseAuth & service-role key safety IDOR risk: user_id from request body used in Supabase query without JWT verification SupabaseAuth & service-role key safety No auth check before a Supabase query in a route handler SupabaseAuth & service-role key safety

Auth hardening & exposure config

7 rules
Email OTP expiry over 1 hour (interception window) SupabaseAuth hardening & exposure config Manual account linking enabled without a product need SupabaseAuth hardening & exposure config Refresh-token reuse interval over 30 seconds SupabaseAuth hardening & exposure config Data API max_rows unbounded or above 10000 SupabaseAuth hardening & exposure config Schemas beyond public exposed through the data API SupabaseAuth hardening & exposure config Unauthenticated edge function SupabaseAuth hardening & exposure config Legacy keys / HS256 still enabled SupabaseAuth hardening & exposure config

Database DR & network

6 rules
Out-of-date Postgres SupabaseDatabase DR & network PITR disabled SupabaseDatabase DR & network Backups failing/none SupabaseDatabase DR & network Disk pressure / read-only lockdown SupabaseDatabase DR & network SSL not enforced SupabaseDatabase DR & network Network open to 0.0.0.0/0 SupabaseDatabase DR & network

Migration & schema safety

5 rules
Migration drops a table or column with no rollback path SupabaseMigration & schema safety RLS enabled on a table but no CREATE POLICY found — app rows locked out SupabaseMigration & schema safety Column type change may silently truncate data SupabaseMigration & schema safety CREATE INDEX on a table without CONCURRENTLY — locks writes during deploy SupabaseMigration & schema safety Postgres extension enabled without review SupabaseMigration & schema safety

Performance advisors

5 rules
Missing index on a hot query column — sequential scan SupabasePerformance advisors N+1 Supabase queries: .from() called inside a loop SupabasePerformance advisors select('*') without .limit() — unbounded result set SupabasePerformance advisors createClient() called inside a request handler — avoids connection reuse SupabasePerformance advisors Unused index — wasted write overhead SupabasePerformance advisors

Realtime & cost

5 rules
Unfiltered Realtime subscription broadcasts every mutation SupabaseRealtime & cost Realtime channel never unsubscribed — connection leak SupabaseRealtime & cost Polling loop queries Supabase on a short interval — use Realtime instead SupabaseRealtime & cost select('*') fetches every column — unnecessary egress SupabaseRealtime & cost Table subscribed via Realtime but absent from the supabase_realtime publication SupabaseRealtime & cost

RLS & tenant isolation

3 rules
RLS disabled on a table — cross-tenant rows accessible SupabaseRLS & tenant isolation No RLS policy found for a queried table — lockout or bypass risk SupabaseRLS & tenant isolation Over-permissive RLS policy on a table — no tenant scoping SupabaseRLS & tenant isolation

Runtime error logs

5 rules
RLS-denial spike SupabaseRuntime error logs Connection-pool exhaustion SupabaseRuntime error logs Statement-timeout/slow-query SupabaseRuntime error logs Repeated constraint violations SupabaseRuntime error logs API 5xx spike SupabaseRuntime error logs

Storage safety

5 rules
Storage bucket is public — objects readable without auth SupabaseStorage safety No RLS policy on storage.objects for a bucket SupabaseStorage safety Storage upload has no MIME type or file-size limit SupabaseStorage safety getPublicUrl() used for user-specific storage object — enumerable by anyone SupabaseStorage safety Signed URL TTL long enough to act as a public URL SupabaseStorage safety

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.

Start for Free View pricing