Supabase and RLS security checklist

Row Level Security is not just a setting checked in the dashboard. Every table exposed through the API needs policies that match product roles. The important test is trying to access another user’s data, not just confirming that a user can see their own.

The public key is meant for client use when RLS protects the data. The service role bypasses those policies and must never reach the browser. If it appeared in a bundle, Git history or public screenshot, treat it as compromised and rotate it.

Knowing who is signed in does not prove they can perform every operation. Check resource ownership, admin roles and state changes in the database or server too, not only by hiding interface buttons.

Buckets, Edge Functions and webhooks can open paths that table policies do not cover. Validate file type and size, authenticate calls and log sensitive operations.