Supabase RLS checklist before you launch

The rule

The Supabase anon (publishable) key is meant to be public. Security depends on RLS. The service_role key bypasses RLS and must never ship in the browser.

Real-world reminder: Wiz’s write-up of Moltbook shows what happens when RLS is missing while the public API key is in client JavaScript (Wiz). Broad scans of vibe-coded Supabase apps continue to find open tables (SymbioticSec).

Checklist

1. In Supabase → Authentication / Table editor: enable RLS on every table.
2. Add policies that use auth.uid() (or your real auth model). Avoid USING (true) for private data.
3. Confirm service_role exists only in server/Edge secrets — search your repo and production JS for it.
4. From an incognito window, call your REST endpoints with only the anon key and verify private rows are denied.
5. Lock down Storage buckets with separate policies.

PreflightVibe’s free scan looks for privileged JWTs and common exposure patterns in your public bundle as a first pass before launch.