Guides
Plain-English security guides for apps built with AI builders on Supabase.
Lovable + Supabase security checklist before launch
Eight checks to run before real users and payments arrive: RLS, admin checks, Stripe webhooks, edge functions, keys, storage, AI limits and headers.
How to check RLS on every Supabase table
Confirm Row Level Security is on for every table with the dashboard, the Security Advisor and a few copy-paste SQL queries, then fix what you find.
Is my Supabase anon key safe in my frontend?
The anon and publishable keys are public by design. When they turn risky, and how to check RLS, policies, grants and secret keys.
Found an API key in your app’s public JavaScript? What to do
Which keys are safe to show, how to rotate the rest in OpenAI, Stripe and Supabase, and how to move calls to the server.
Supabase’s October 30 change: fix “permission denied” safely
New tables need an explicit grant from October 30. How to fix error 42501 without making your data readable by anyone.