Supabase Security Best Practices

Comprehensive security guide for Supabase projects. Contains rules across 6 categories, prioritized by impact to guide secure configuration, RLS policy design, and authentication patterns.

When to Apply

Reference these guidelines when:

• Writing or reviewing RLS policies
• Configuring Supabase Auth (OAuth, email, sessions)
• Setting up storage bucket policies
• Securing realtime channel subscriptions
• Writing or reviewing edge functions
• Auditing a Supabase project before launch
• Reviewing API exposure and anon key usage

Rule Categories by Priority