Guide
Is Supabase secure?
Supabase is secure when you use it correctly, and the one thing that decides it is row-level security. With RLS enabled and scoped policies, the public key in your app is safe to expose; with RLS off, that same key reads your whole database.
Supabase is safe by design, not by default
Supabase is built to be exposed to the browser. It hands your app a publishable key on purpose. What keeps that key from reading everything is row-level security, the per-row access rules you configure. Supabase does not turn those on for you, so a new project can have the platform's security features available and none of them in effect.
With RLS off, the public key in your app reads your whole database.
What makes a Supabase app secure
- Row-level security on every table that holds user or private data.
- A policy per table scoping reads and writes to the owning user.
- The service-role key server-side only, never in client code.
Scan your live app with Plaintext to confirm the database is actually closed, not just configured to be.
Frequently asked
Is Supabase secure?
Supabase is secure when row-level security is enabled with correct policies. It is a well-built platform, but its safety depends on configuration: with RLS off, the public key in every Supabase app can read the whole table.
What is the biggest Supabase security risk?
Row-level security left off. It is the control that makes the public key safe to ship. Without it, anyone who opens your app can query your tables directly.
Check your own app in about a minute. Paste your URL and Plaintext reads the shipped JavaScript, the public endpoints, and the database rules for the exact holes Supabase-backed apps leave open. The first scan is free.
Scan my app