Supabase Policy Guardrails

Prerequisites

• ESLint configured in project
• Pre-commit hooks infrastructure
• CI/CD pipeline with policy checks
• TypeScript for type enforcement

Instructions

Policy guardrails for Supabase work best as a defense-in-depth system where violations are caught at the earliest possible stage: lint rules catch issues at code authoring time, pre-commit hooks catch issues before they enter the repository, CI checks enforce policy on every pull request, and runtime guardrails prevent dangerous operations from executing in production even if earlier checks were bypassed.

Step 1: Create ESLint Rules

Implement custom lint rules that flag Supabase-specific anti-patterns: using the service role key in files under src/, calling .select() without specifying column names, and making Supabase queries outside the designated service layer. Rules should provide actionable error messages that explain the problem and suggest the correct alternative.

Step 2: Configure Pre-Commit Hooks

Set up hooks using Husky or a similar tool to scan staged files for hardcoded Supabase keys or connection strings before they enter the commit history. Once a secret is committed, rotation is the only safe remediation, so catching it pre-commit is far less disruptive than discovering it post-push.

Step 3: Add CI Policy Checks

Implement policy-as-code checks in CI that verify RLS is enabled on all non-public tables and that migration files do not contain data-destructive statements without explicit approval annotations.