Security for apps built on Supabase
Supabase lets you build fast, and that speed is also how security steps get skipped. Start with a free, passive snapshot of what your domain shows the public internet, then see the Supabase-specific risk the outside view can't reach.
Fast to build, easy to expose
Supabase hands you a database, authentication and APIs in minutes. The trade-off is that the safe configuration is yours to get right. The gaps we see most often in Supabase apps are a database table left publicly readable, an API key doing more in the browser than it should, and the ordinary web hardening, HTTPS, security headers, email anti-spoofing, that simply never got set up.
The outside view can’t see this
The one that catches people out: publicly readable tables
Supabase controls access with Row Level Security (RLS). If a table has RLS turned off, or a policy that is too permissive, the public anon key that ships in your app's front-end can read, and sometimes write, that table directly, with no login. It is the single most common serious issue in apps built quickly on Supabase, and it is invisible from the outside: a passive external check cannot see it. You have to check it against your own project.
What the free Surface Check covers for your Supabase app
- HTTPS and HSTS on your custom domain, so traffic can't be silently downgraded to plain HTTP.
- Security headers (Content-Security-Policy, clickjacking protection, nosniff) on your front-end.
- Your TLS certificate's health and how soon it expires.
- Cookie flags (HttpOnly, Secure, SameSite) on any session or auth cookies you set.
- Email spoofing: SPF, DKIM and DMARC on your domain, so attackers can't send email as you.
See your external surface in about a minute
A free, passive snapshot with an A-to-F Surface Score and every issue scored by severity and fix effort. No sign-up, and nothing is stored.
Run the free Surface Check →Frequently asked
Does the Surface Check log into my Supabase project?
No. It is completely passive and reads only what your domain shows the public internet: response headers, your TLS certificate, cookie flags and public DNS records. It never signs in, never uses your keys, and never touches your database.
Will it tell me if my tables are publicly readable?
Not directly. That lives inside your project, which an external check can't reach. Our guide walks you through checking it yourself in a couple of minutes, and a full Secvura review checks it as standard.
We built the app with an AI tool on top of Supabase. Does that change anything?
It raises the odds. AI-generated apps ship quickly and often leave RLS off or an over-powered key in the browser, precisely because the security step is the easy one to skip. It is worth checking both your external surface and your database access.
Is the check really free?
Yes, free and with no sign-up. You get an A-to-F Surface Score and every issue scored by severity and fix effort, the same way we score a full report.
More free checks