Supabase
What LetMeCheck checks if your app uses Supabase, and how to lock down your tables and storage.
ON THIS PAGE
Many apps built with Lovable, Bolt and similar tools use Supabase for their database. Supabase is safe when it's set up well, and the most common problems are small settings that are easy to miss. This page explains what LetMeCheck looks at and what you should check yourself.
What a website check does#
A website check can't see inside your database, but it can see what your site gives away:
- It spots that you use Supabase and reminds you to switch on Row Level Security for every table the site can reach. This is advice and doesn't change your score.
- It looks for a service role key in the code your site sends to the browser. That key skips every security rule, so finding it is a critical problem. See service role key.
- It doesn't flag your anon key. The anon key is meant to be public, so having it in your site is normal.
What a full check adds#
A full check reads your code through read-only GitHub access. It can look for open database rules and keys in your code that a website check can't see. See Quick check vs full check.
Check your Supabase project yourself#
These take a few minutes and catch most problems:
- Row Level Security. In your Supabase dashboard, open Table Editor. Any table marked "RLS disabled" or "Unrestricted" can be read by anyone with your public key. Turn it on and add a policy for each action. See row level security.
- Policies. For each table with RLS on, open Authentication → Policies and check there is at least one policy. A table with RLS on and no policies blocks everyone, which breaks your app. An overly broad policy lets everyone in.
- Storage. Open Storage and look for buckets marked Public. Make a bucket private if it holds personal files, and use short-lived links instead. See public storage bucket.
- Keys. Make sure the service role key only appears in server code, never in files your site sends to visitors.
If a service role key was ever visible on your site or in your repository, reset it in your Supabase project settings first, then update the places that use it.
Fix it with your AI tool#
Open the issue in your report, click Copy fix prompt and paste it into your AI tool. See Use fix prompts. After the change, run the check again.
Related#
Last updated
Was this page helpful?