Supabase security checklist for AI-built apps (Lovable, Bolt, Cursor)
AI tools build Supabase apps fast, but often leave the database open. A practical checklist to find and fix the most common Supabase security holes before your users do.
By Code Rivals · 12 November 2026 · 6 min read
Key takeaways
- Turn on row level security for every table and write a policy for each action.
- Never ship the service role key to the browser.
- Lock down storage buckets and edge functions, not just tables.
- Test as a logged-out user and as a second user before you launch.
Why AI-built Supabase apps are often exposed
Supabase lets the browser talk directly to your database. That is safe only when row level security (RLS) policies decide who can read and write each row. AI tools often create tables without policies, or with policies that allow everything, because that makes the demo work first time.
The result is an app that looks fine but lets anyone with your public key read every user's data. It is one of the most common problems we find when reviewing vibe-coded apps.
The checklist
Go through these in your Supabase dashboard and code:
- RLS is enabled on every table in the public schema
- Each table has separate policies for select, insert, update and delete
- Policies check auth.uid() against the row's owner, not just that a user is logged in
- The service_role key is only used on the server, never in frontend code or environment variables starting with NEXT_PUBLIC_ or VITE_
- Storage buckets are private unless files are truly public, with policies per folder
- Edge functions verify the user's JWT before doing anything
- Database functions marked security definer cannot be abused to bypass RLS
- Old test tables and unused columns with personal data are removed
How to test it
Open your app in a private window without logging in and try to load data through the API using only your public anon key. Then create two test accounts and check that user A cannot see, edit or delete anything belonging to user B. If either test leaks data, fix the policies before anything else.
When to get help
If you find exposed data, act quickly: fix the policies, rotate any leaked keys and check your logs for unusual access. Code Rivals reviews and fixes Supabase security for apps built with Lovable, Bolt, Cursor and similar tools, usually starting with a fixed-price code review.
Want a second pair of eyes on your Supabase setup?
Get your app reviewed