Stripe & SupabaseSeverity critical

Supabase RLS disabled or misconfigured

Supabase's anon key is public by design — it's in your JS bundle. Row Level Security (RLS) is the only thing stopping anyone from using that key to read the raw content of your database directly.

Two variants of this vulnerability

Table readable without authentication — RLS enabled but with an overly permissive policy (USING (true)), or RLS flat-out disabled on the table.
Exposed service_role key — this key bypasses RLS entirely. If it ends up client-side, that's full read/write access to the entire database, a critical vulnerability.

The fix

ALTER TABLE profiles ENABLE ROW LEVEL SECURITY;

CREATE POLICY "users_read_own_profile" ON profiles
  FOR SELECT
  TO authenticated
  USING (auth.uid() = user_id);

If a service_role key has leaked, rotate it immediately in the Supabase dashboard — it should never leave the server.

Full guide to the three most common RLS traps and a checklist to run before going to production:

Read the full article

Check whether your site is affected by this vulnerability.

Scan my app