Bolt.new + Next.js + Supabase Security Blueprint

To secure a Bolt.new + Next.js + Supabase stack, get four things right: the correct Supabase client for each Next.js context (browser vs. server vs. middleware), auth.getUser() checks on every Server Action, RLS enabled on all tables, and middleware guarding authenticated routes. Miss any one and Bolt's generated code will happily ship with a hole in it. This blueprint walks through the specific ways Next.js App Router and Supabase trip each other up.

Setup Time2-3 hours

TL;DR

Next.js App Router needs a different Supabase client depending on where the code runs. Bolt mixes these up constantly, and it's easy to skip auth verification in Server Actions entirely. After export, check your client usage, add auth checks everywhere, turn on RLS, and lock down routes with middleware.

Supabase Client Types

Context	Client	Common Issue
Client Components	createBrowserClient	May use server client
Server Components	createServerClient	May skip cookie handling
Server Actions	createServerClient	Often missing auth check

Part 1: Next.js Server Action Security

SECURE: With auth verification

'use server'

import { createClient } from '@/lib/supabase/server'

export async function updateProfile(formData: FormData) {
  const supabase = await createClient()

  const { data: { user }, error } = await supabase.auth.getUser()

  if (error || !user) {
    throw new Error('Unauthorized')
  }

  await supabase.from('profiles').update({
    name: formData.get('name')
  }).eq('id', user.id)  // Use verified user ID

  return { success: true }
}

Critical: always use auth.getUser() in Server Actions. Don't trust a user ID that came from form data, it's trivial to spoof.

Security Checklist

Post-Export Checklist for Bolt + Next.js + Supabase

Correct Supabase client for each context

RLS enabled on all tables

Auth verification in all Server Actions

Middleware protects authenticated routes

User ID from auth.getUser(), not client

Service role key only in server code

Alternative Stacks to Consider

      **Bolt.new + Supabase**
      General Supabase security guide


      **Bolt.new + Supabase + Vercel**
      Complete deployment security


      **Bolt.new + React + Firebase**
      Firebase alternative stack

Why do I need different Supabase clients?

Next.js runs your code in different environments, and each one handles cookies and auth tokens its own way. Grab the wrong client and you get auth state mismatches, usually the "logged in on the client, logged out on the server" kind.

Building Next.js + Supabase with Bolt?

Scan for client misuse and auth vulnerabilities.