A sample code audit of a Supabase app

Found with: grep -ohE 'eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+' dist/assets/*.js | sort -u
Then, for each key: the file it's in, and its payload, base64-decoded:
index-BncN2ysr.js: {"iss":"supabase-demo","role":"anon","exp":1983812996}
index-BncN2ysr.js: {"iss":"supabase-demo","role":"service_role","exp":1983812996}

$ curl -X GET 'http://127.0.0.1:55321/auth/v1/admin/users?per_page=100' \
  -H 'apikey: <service-role key>' \
  -H 'Authorization: Bearer <service-role key>'
HTTP 200
{
  "total": 7,
  "first_three": [
    {
      "email": "[email protected]",
      ...

// _shared/keys.ts
function keyFrom(variable: string, legacy: string): string {
  const keys = Deno.env.get(variable);
  if (keys) {
    return (JSON.parse(keys) as Record<string, string>)["default"];
  }
  return Deno.env.get(legacy)!;
}

export const secretKey = () => keyFrom("SUPABASE_SECRET_KEYS", "SUPABASE_SERVICE_ROLE_KEY");

// admin-users/index.ts
const { data: isAdmin, error } = await asCaller.rpc("is_admin");
if (error || isAdmin !== true) {
  return json({ error: "Admins only" }, 403);
}

const admin = createClient(SUPABASE_URL, secretKey());

$ curl -X GET 'http://127.0.0.1:55321/rest/v1/invoices?select=number,status,amount_cents,workspace_id&order=workspace_id,number&limit=4' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <anon key>' \
  -H 'Prefer: count=exact'
HTTP 206
Content-Range: 0-3/68
[
  {
    "number": "INV-2026-0001",
    "status": "paid",
    "amount_cents": 522500,
    "workspace_id": "a1de5000-0000-4000-8000-000000000001"
  },
  ...

begin;

drop policy "Enable read access for all users" on public.invoices;

create policy "Clients read their own invoices"
on public.invoices for select
to authenticated
using (
  client_id in (
    select c.id from public.clients c
    where c.user_id = (select auth.uid())
  )
);

-- Signed-out visitors never need invoices.
revoke all on table public.invoices from anon;

commit;

$ curl -X POST 'http://127.0.0.1:55321/storage/v1/object/list/invoices' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <anon key>' \
  -H 'Content-Type: application/json' \
  -d '{"prefix": "a1de5000-0000-4000-8000-000000000001", "limit": 100}'
HTTP 200
{
  "files": 60,
  "first_three": [
    "INV-2026-0001.pdf",
    "INV-2026-0002.pdf",
    "INV-2026-0003.pdf"
  ]
}

$ curl -X POST 'http://127.0.0.1:55321/storage/v1/object/invoices/a1de5000-0000-4000-8000-000000000001/INV-2026-0003.pdf' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <Ana's access token>' \
  -H 'Content-Type: application/pdf' \
  -H 'x-upsert: true' \
  --data-binary '@replacement.pdf'
HTTP 200
...

$ curl -X GET 'http://127.0.0.1:55321/storage/v1/object/public/invoices/a1de5000-0000-4000-8000-000000000001/INV-2026-0003.pdf'
HTTP 200
(a PDF, 887 bytes. Its text lines:)
  Alder Studio
  Invoice INV-2026-0003
  Billed to: Brightline Coffee, Sam Rivera <[email protected]>
  Amount due: REPLACED BY ANA, A CLIENT OF ANOTHER STUDIO
  ...

update storage.buckets
set public = false,
    allowed_mime_types = array['application/pdf'],
    file_size_limit = 10485760
where id = 'invoices';

drop policy "Invoice files are publicly accessible" on storage.objects;
drop policy "Authenticated users can upload invoice files" on storage.objects;
drop policy "Authenticated users can update invoice files" on storage.objects;

-- A client reads a file only through one of their own invoices that names it,
-- where the invoice, the client and the file's folder all belong to the same
-- studio. Anyone can create a studio and be its staff and its client, so an
-- invoice they write must not reach another studio's files.
create policy "Clients read their own invoice files"
on storage.objects for select
to authenticated
using (
  bucket_id = 'invoices'
  and exists (
    select 1
    from public.invoices i
    join public.clients c on c.id = i.client_id
    where i.pdf_path = storage.objects.name
      and c.workspace_id = i.workspace_id
      and (storage.foldername(storage.objects.name))[1] = i.workspace_id::text
      and c.user_id = (select auth.uid())
  )
);

-- And at the source: an invoice's file is always its own studio's, under its
-- own number, which is the path the app writes.
alter table public.invoices
  add constraint invoices_pdf_path_matches_invoice
  check (pdf_path is null or pdf_path = workspace_id::text || '/' || number || '.pdf');

-- Plus: staff read, upload and replace their own studio's files.

$ curl -X GET 'http://127.0.0.1:55321/rest/v1/messages?select=body,created_at,workspace_id&order=created_at&limit=3' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <anon key>' \
  -H 'Prefer: count=exact'
HTTP 206
Content-Range: 0-2/44
[
  {
    "body": "First round of concepts is up in the files tab. Three directions, notes on each.",
    "created_at": "2026-01-15T09:00:00+00:00",
    "workspace_id": "a1de5000-0000-4000-8000-000000000001"
  },
  ...

$ curl -X POST 'http://127.0.0.1:55321/rest/v1/messages?select=id,sender_id,body' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <anon key>' \
  -H 'Content-Type: application/json' \
  -H 'Prefer: return=representation' \
  -d '{"workspace_id": "a1de5000-0000-4000-8000-000000000001", "project_id": "587266a9-2899-b979-48d2-e53e8f63e615", "sender_id": "11111111-1111-4111-8111-111111111111", "body": "Posted signed out by the audit script."}'
HTTP 201
...

alter table public.messages enable row level security;
revoke all on table public.messages from anon;

-- Posts go out under the sender's own ID, on a project they can see, with the
-- project's real studio ID.
create policy "Members post as themselves on their projects"
on public.messages for insert
to authenticated
with check (
  sender_id = (select auth.uid())
  and exists (
    select 1 from public.projects p
    where p.id = messages.project_id
      and p.workspace_id = messages.workspace_id
      and (
        public.is_workspace_staff(p.workspace_id)
        or exists (
          select 1 from public.clients c
          where c.id = p.client_id and c.user_id = (select auth.uid())
        )
      )
  )
);

-- Plus two select policies: staff, and clients on their own projects.

$ curl -X POST 'http://127.0.0.1:55321/rest/v1/workspace_members' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <Ana's access token>' \
  -H 'Content-Type: application/json' \
  -H 'Prefer: return=minimal' \
  -d '{"workspace_id": "a1de5000-0000-4000-8000-000000000001", "user_id": "66666666-6666-4666-8666-666666666666", "role": "owner"}'
HTTP 201

$ curl -X GET 'http://127.0.0.1:55321/rest/v1/projects?select=name&workspace_id=eq.a1de5000-0000-4000-8000-000000000001&limit=3' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <Ana's access token>' \
  -H 'Prefer: count=exact'
HTTP 206
Content-Range: 0-2/30
...

drop policy "Users can join workspaces" on public.workspace_members;

-- Explicit grants, not the API's old defaults: since October 30, 2026, hosted
-- projects don't expose new tables on their own. The browser sets only the
-- studio, the address and the role. The token, expiry, creator and acceptance
-- time come from the database.
revoke all on table public.workspace_invites from anon, authenticated;
grant select, delete on table public.workspace_invites to authenticated;
grant insert (workspace_id, email, role) on table public.workspace_invites to authenticated;

create function public.accept_invite(invite_token text)
returns uuid
language plpgsql
security definer
set search_path = ''
as $$
declare
  invite public.workspace_invites%rowtype;
begin
  select * into invite
  from public.workspace_invites
  where token = invite_token
    and accepted_at is null
    and expires_at > now()
  for update;

  if not found then
    raise exception 'invite not found or expired' using errcode = 'P0002';
  end if;

  if lower(invite.email) <> lower((select u.email from auth.users u where u.id = auth.uid())) then
    raise exception 'this invite is for another address' using errcode = '42501';
  end if;

  -- A new member gets the invite's role. An existing client invited as staff
  -- becomes staff. Nobody is moved down, and an owner stays an owner.
  insert into public.workspace_members as m (workspace_id, user_id, role)
  values (invite.workspace_id, auth.uid(), invite.role)
  on conflict (workspace_id, user_id) do update
    set role = excluded.role
    where m.role = 'client' and excluded.role = 'staff';

  update public.workspace_invites set accepted_at = now() where id = invite.id;

  return invite.workspace_id;
end;
$$;

$ curl -X PATCH 'http://127.0.0.1:55321/rest/v1/profiles?id=eq.33333333-3333-4333-8333-333333333333&select=id,email,role' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <Sam's access token>' \
  -H 'Content-Type: application/json' \
  -H 'Prefer: return=representation' \
  -d '{"role": "admin"}'
HTTP 200
Content-Range: 0-0/*
[
  {
    "id": "33333333-3333-4333-8333-333333333333",
    "email": "[email protected]",
    "role": "admin"
  }
]

begin;

revoke insert, update on table public.profiles from anon, authenticated;
grant insert (id, full_name, avatar_url) on table public.profiles to authenticated;
grant update (full_name, avatar_url) on table public.profiles to authenticated;

-- The plan changes only from server-side billing code, with the secret key.
revoke insert, update on table public.workspaces from anon, authenticated;
grant insert (name, slug, owner_id) on table public.workspaces to authenticated;
grant update (name, slug) on table public.workspaces to authenticated;

commit;

$ curl -X GET 'http://127.0.0.1:55321/rest/v1/clients?select=company,email' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <anon key>'
HTTP 200
[]

$ curl -X GET 'http://127.0.0.1:55321/rest/v1/client_overview?select=company,name,email,open_invoices,amount_due_cents,workspace_id&order=company' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <anon key>'
HTTP 200
Content-Range: 0-4/*
[
  {
    "company": "Brightline Coffee",
    "name": "Sam Rivera",
    "email": "[email protected]",
    "open_invoices": 5,
    "amount_due_cents": 1550000,
    "workspace_id": "a1de5000-0000-4000-8000-000000000001"
  },
  ...

alter view public.client_overview set (security_invoker = true);
revoke all on table public.client_overview from anon;

$ curl -X POST 'http://127.0.0.1:55321/functions/v1/invoice-pdf' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <anon key>' \
  -H 'Content-Type: application/json' \
  -d '{"workspace": "alder", "number": "INV-2026-0007"}'
HTTP 200
{
  "studio": "Alder Studio",
  "invoice": {
    ...
    "number": "INV-2026-0007",
    ...
    "clients": {
      "name": "Sam Rivera",
      "email": "[email protected]",
      "company": "Brightline Coffee"
    }
  },
  "pdfUrl": "<internal API URL>/storage/v1/object/sign/invoices/a1de5000-0000-4000-8000-000000000001/INV-2026-0007.pdf?token=<jwt>"
}

Signed out: walk the invoice numbers INV-2026-0001 to INV-2026-0060
Opened 60 of 60 invoices, naming 3 distinct client email addresses.

// invoice-pdf/index.ts
const supabase = createClient(SUPABASE_URL, publishableKey(), {
  global: { headers: { Authorization: authHeader } },
});

const {
  data: { user },
} = await supabase.auth.getUser(authHeader.replace("Bearer ", ""));
if (!user) {
  return json({ error: "Sign in to open this invoice" }, 401);
}
// ...
return json({ studio: invoice.workspaces.name, invoice });

// src/pages/InvoiceView.tsx
const pdfUrl = data.invoice.pdf_path ? await signedInvoiceUrl(data.invoice.pdf_path) : null;

$ curl -X GET 'http://127.0.0.1:55321/rest/v1/app_settings?select=key,value' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <anon key>'
HTTP 200
[]

$ curl -X POST 'http://127.0.0.1:55321/rest/v1/rpc/get_pdf_settings' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <anon key>' \
  -H 'Content-Type: application/json' \
  -d '{}'
HTTP 200
{
  "api_key": "pdfr_live_3a9f<rest of the PDF service key>",
  "template_id": "tmpl_invoice_v2"
}

revoke execute on function public.get_pdf_settings() from public, anon, authenticated;
delete from public.app_settings where key = 'pdf_api_key';

$ curl -X GET 'http://127.0.0.1:55321/rest/v1/profiles?select=id,full_name,email&order=email' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <Sam's access token>'
HTTP 200
Content-Range: 0-3/*
[
  {
    "full_name": "Leo Park",
    "email": "[email protected]"
  },
  {
    "full_name": "Maya Chen",
    "email": "[email protected]"
  },
  {
    "full_name": "Priya Shah",
    "email": "[email protected]"
  },
  ...

drop policy "Members can view workspace members" on public.workspace_members;

create policy "Staff read their studio's memberships"
on public.workspace_members for select
to authenticated
using ( public.is_workspace_staff(workspace_id) );

create policy "Members read their own membership and their studio's staff"
on public.workspace_members for select
to authenticated
using (
  user_id = (select auth.uid())
  or (role in ('owner', 'staff') and public.is_workspace_member(workspace_id))
);

-- The memberships a caller can read now decide whose profiles they can read.
drop policy "Members can view profiles in their workspaces" on public.profiles;

create policy "Members read the profiles of memberships they can see"
on public.profiles for select
to authenticated
using (
  exists (
    select 1 from public.workspace_members m
    where m.user_id = profiles.id
  )
);

$ curl -X DELETE 'http://127.0.0.1:55321/rest/v1/workspace_members?workspace_id=eq.a1de5000-0000-4000-8000-000000000001&user_id=eq.33333333-3333-4333-8333-333333333333&select=user_id,role' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <Maya's access token>' \
  -H 'Prefer: return=representation'
HTTP 200
...
Memberships Sam has at Alder now: 0.

$ curl -X GET 'http://127.0.0.1:55321/rest/v1/projects?select=name&client_id=eq.c1000000-0000-4000-8000-000000000001&limit=2' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <Sam's access token>' \
  -H 'Prefer: count=exact'
HTTP 206
Content-Range: 0-1/10
[
  {
    "name": "Brightline Coffee: Brand refresh"
  },
  ...

begin;

create function public.unlink_removed_client()
returns trigger
language plpgsql
security definer
set search_path = ''
as $$
begin
  update public.clients
  set user_id = null
  where workspace_id = old.workspace_id
    and user_id = old.user_id;
  return old;
end;
$$;

revoke execute on function public.unlink_removed_client() from public, anon, authenticated;

create trigger on_workspace_member_removed
  after delete on public.workspace_members
  for each row execute function public.unlink_removed_client();

commit;

$ curl -X POST 'http://127.0.0.1:55321/auth/v1/signup' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <anon key>' \
  -H 'Content-Type: application/json' \
  -d '{"email": "[email protected]", "password": "123456"}'
HTTP 200
{
  "access_token": "<new account's access token>",
  ...
  "user": {
    ...
    "email": "[email protected]",
    "email_confirmed_at": "2026-11-06T04:24:24.450404339Z",
    ...

minimum_password_length = 10
password_requirements = "lower_upper_letters_digits"

[auth.email]
enable_confirmations = true
secure_password_change = true

$ supabase test db
...
# Failed test 5: "signed out: no invoices"
#         have: 68
#         want: 0
...
# Failed test 23: "Sam: can't read Priya's PDF through an invoice he writes in a studio of his own"
#         have: 1
#         want: 0
...
# Failed test 31: "after Maya removes Sam, he reads none of his projects, invoices, messages or files"
#         have: 126
#         want: 0
...
# Looks like you failed 35 tests of 37
...
Result: FAIL

name: Access checks

on:
  push:
    branches: [main]
  pull_request:

jobs:
  access-rules:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: supabase/setup-cli@v1
        with:
          version: 2.31.4
      - run: supabase db start
      - run: supabase test db

  bundle-keys:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm ci
      - run: npm run build
      - run: scripts/check-bundle-keys.sh dist

Files in the app that mention a backup or restore: none
Invoice PDFs in storage: 68. Database backups hold their metadata rows in storage.objects, not the files.

$ scripts/restore-drill.sh
dumped the auth, storage and public schemas, with their grants, to a file only its owner can read
restored into a scratch database, with 0 errors
skipped 18 statements that set default privileges for Supabase's admin roles, which only they can run
row counts match in all 35 tables
row level security and view options match on all 20 tables and views in public and storage
all 60 policies match, word for word
the API roles' grants in public match: 218 on tables and views, 13 on single columns, 21 on functions
copied 68 of 68 files from the invoices bucket; 68 match the MD5 in their storage metadata, 0 had none to compare
deleted the dump and dropped the scratch database
...
DRILL PASSED

$ curl -X POST 'http://127.0.0.1:55321/rest/v1/projects' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <Tom's access token>' \
  -H 'Content-Type: application/json' \
  -H 'Prefer: return=minimal' \
  -d '{"workspace_id": "b1de5000-0000-4000-8000-000000000002", "client_id": "c1000000-0000-4000-8000-000000000001", "name": "Juniper Dev: Website build"}'
HTTP 201

$ curl -X GET 'http://127.0.0.1:55321/rest/v1/projects?select=name,workspace_id&client_id=eq.c1000000-0000-4000-8000-000000000001&workspace_id=eq.b1de5000-0000-4000-8000-000000000002' \
  -H 'apikey: <anon key>' \
  -H 'Authorization: Bearer <Sam's access token>' \
  -H 'Prefer: count=exact'
HTTP 200
Content-Range: 0-0/1
[
  {
    "name": "Juniper Dev: Website build",
    "workspace_id": "b1de5000-0000-4000-8000-000000000002"
  }
]

alter table public.clients add constraint clients_id_workspace_id_key unique (id, workspace_id);
alter table public.projects add constraint projects_id_workspace_id_key unique (id, workspace_id);

alter table public.projects drop constraint projects_client_id_fkey;
alter table public.projects
  add constraint projects_client_in_same_studio_fkey
  foreign key (client_id, workspace_id) references public.clients (id, workspace_id)
  on delete set null (client_id);

-- Plus the same for an invoice's client and project.

Code: Dashboard.tsx:15:    refetchInterval: 10000,
Code: Dashboard.tsx:25:      for (const project of projects) {
Requests: 31. Response bytes: 7891. Wall time on this machine: 479 ms.
The same data in one request with an embedded select: 1 request, 8371 bytes, 211 ms.
At one refresh every 10 seconds, one open tab sends 11160 requests an hour, about 2774 KB of responses.

const { data, error } = await supabase
  .from("projects")
  .select("id, name, status, due_date, client_id, invoices(amount_cents, status)")
  .eq("workspace_id", workspace!.id)
  .order("created_at", { ascending: false });

Performance lints from the local advisor (output/1-vulnerable/checks/advisor-lints.json):
    14 INFO  unindexed_foreign_keys
     1 INFO  unused_index
    11 WARN  auth_rls_initplan
    20 WARN  multiple_permissive_policies
...
Foreign keys whose columns lead no index, from the database itself:
  clients.clients_user_id_fkey
  clients.clients_workspace_id_fkey
  invoices.invoices_client_id_fkey
  ... (8 more)

create index if not exists clients_user_id_idx on public.clients (user_id);
create index if not exists invoices_client_id_workspace_id_idx on public.invoices (client_id, workspace_id);

drop policy "Users can view their own profile" on public.profiles;
create policy "Users can view their own profile"
on public.profiles for select
to authenticated
using ( (select auth.uid()) = id );