TL;DR
Enable RLS on every table. Write policies for SELECT, INSERT, UPDATE, DELETE. Keep the service role key server-side only. Configure storage bucket policies. This 24-item checklist covers all Supabase security essentials. 7 critical items must be fixed before launch, 10 important items within the first week, and 7 recommended items when you can.
Supabase gives you a Postgres database with a direct API, which is powerful but means misconfigured RLS can expose your entire dataset to the internet. I have seen too many projects ship with RLS disabled "temporarily" and forget about it. Walk through each item here, especially if you set up your tables in a hurry.
Quick Checklist (5 Critical Items)
::checklist-item{label="RLS enabled on ALL tables" description="Check each table - "RLS Enabled" should be green"} ::
Row Level Security (RLS) 6
::checklist-item{label="RLS enabled on ALL tables" description="Check each table in Supabase dashboard - "RLS Enabled" should be green. How to set up Supabase RLS"} ::
Example RLS policy for user-owned data:
-- Users can only see their own profiles
CREATE POLICY "Users can view own profile"
ON profiles FOR SELECT
USING (auth.uid() = user_id);
-- Users can only update their own profile
CREATE POLICY "Users can update own profile"
ON profiles FOR UPDATE
USING (auth.uid() = user_id);
API Keys 4
Storage Buckets 4
Example storage policy:
-- Users can upload to their own folder
CREATE POLICY "Users can upload own files"
ON storage.objects FOR INSERT
WITH CHECK (
bucket_id = 'avatars' AND
auth.uid()::text = (storage.foldername(name))[1]
);
Authentication 4
Edge Functions 3
Database 3
How to Use This Checklist
Go through each item before deploying your Supabase project. If you find an issue, fix it before moving on. Use the Supabase Dashboard's "API Docs" to test your RLS policies. Try accessing data as different users to verify policies work correctly.
What is Row Level Security (RLS) in Supabase?
Row Level Security is a PostgreSQL feature that allows you to control which rows a user can access. In Supabase, RLS policies ensure users can only read, insert, update, or delete rows they're authorized to access based on their authentication status.
What's the difference between anon key and service role key?
The anon key is safe for browser use and respects RLS policies. The service role key bypasses all RLS and should ONLY be used server-side. Never expose the service role key in client-side code.
Do I need RLS if I only access Supabase from the server?
Yes. Even with server-only access, RLS provides defense in depth. If your server-side code has a bug or vulnerability, RLS can prevent unauthorized data access. It's an important security layer.
Automate This Checklist
Our scanner checks all these items automatically and catches issues you might miss.