← all checklists

Supabase

23 items · source

Copy as markdown

Filter items

Architecture & Threat Model

• Draw the complete request/data-flow diagram from browser/mobile → Cloudflare → Cloud Run → NestJS → Supabase/Auth/Postgres/Storage → third parties.

Authentication & Authorization

• Search frontend/mobile bundles for Supabase service-role credentials.
• Verify session handling in SSR does not accidentally share one Supabase client/session across users.

Secrets Management & Cryptography

• Identify Supabase service-role credentials.

Monitoring, Detection & Incident Response

• Document how to revoke Supabase credentials.

Pre-Release Gates

• Any Supabase service-role credential exposed to a client.
• Supabase service_role key
• Verify production Supabase settings.
• Supabase RLS audit complete.
• Supabase Storage audit complete.
• Supabase Auth audit complete.

AI Security Architecture & Identity

• AI does not receive Supabase service_role credentials unless absolutely unavoidable and isolated.

Prompt Injection & Goal Hijacking

Test hostile instructions inside:

• Supabase rows
• Supabase Storage objects

Tool Calling & Excessive Agency

Pay special attention to agents with:

• Supabase administration

AI Data Access & Privacy

• AI never receives Supabase service-role keys in user-controlled context.

AI Release Gate

The security architecture should explicitly treat all of these as untrusted unless independently verified:

• Supabase rows

AI-Generated Authorization & Data Bugs

• AI did not add service_role access where anon/authenticated access was sufficient.

AI-Generated Crypto, Dependency & Config Bugs

Review every AI-generated:

• Supabase configuration

Review Blind Spots

• Verify old Supabase auth patterns are not copied into current SSR architecture.

Agent Prompts & PR Review

Can an attacker reach the same operation another way?

• direct Supabase.

Vibe-Coding Release Gate

• AI changed Supabase policies.
• AI introduced service_role.