TL;DR
Enable RLS on every table. Write policies for SELECT, INSERT, UPDATE, DELETE. Keep the service role key server-side only. Configure storage bucket policies. This 24-item checklist covers all Supabase security essentials. 7 critical items must be fixed before launch, 10 important items within the first week, and 7 recommended items when you can.
Quick Checklist (5 Critical Items)
::checklist-item{label="RLS enabled on ALL tables" description="Check each table - "RLS Enabled" should be green"} ::
Row Level Security (RLS) 6
::checklist-item{label="RLS enabled on ALL tables" description="Check each table in Supabase dashboard - "RLS Enabled" should be green. How to set up Supabase RLS"} ::
Example RLS policy for user-owned data:
-- Users can only see their own profiles
CREATE POLICY "Users can view own profile"
ON profiles FOR SELECT
USING (auth.uid() = user_id);
-- Users can only update their own profile
CREATE POLICY "Users can update own profile"
ON profiles FOR UPDATE
USING (auth.uid() = user_id);
API Keys 4
Storage Buckets 4
Example storage policy:
-- Users can upload to their own folder
CREATE POLICY "Users can upload own files"
ON storage.objects FOR INSERT
WITH CHECK (
bucket_id = 'avatars' AND
auth.uid()::text = (storage.foldername(name))[1]
);
Authentication 4
Edge Functions 3
Database 3
How to Use This Checklist
Go through each item before deploying your Supabase project. If you find an issue, fix it before moving on. Use the Supabase Dashboard's "API Docs" to test your RLS policies. Try accessing data as different users to verify policies work correctly.
What is Row Level Security (RLS) in Supabase?
Row Level Security is a PostgreSQL feature that allows you to control which rows a user can access. In Supabase, RLS policies ensure users can only read, insert, update, or delete rows they're authorized to access based on their authentication status.
What's the difference between anon key and service role key?
The anon key is safe for browser use and respects RLS policies. The service role key bypasses all RLS and should ONLY be used server-side. Never expose the service role key in client-side code.
Do I need RLS if I only access Supabase from the server?
Yes. Even with server-only access, RLS provides defense in depth. If your server-side code has a bug or vulnerability, RLS can prevent unauthorized data access. It's an important security layer.
Automate This Checklist
Our scanner checks all these items automatically and catches issues you might miss.
Start Free Scan