Unauthenticated edge function

What it is

An edge function is deployed with verify_jwt disabled, so it accepts requests without a valid Supabase JWT.

Why it matters

The function URL is public and guessable, and the function itself typically holds service credentials. Anything it does becomes available to anyone who finds the endpoint.

How to fix it

Enable verify_jwt for the function. If it must be public — a webhook receiver, for instance — authenticate the caller another way, such as a shared secret or a provider signature, and check it before doing any work.