Vibe coding security checklist

Supabase dashboard → Advisors → Security Advisor. Each finding links to a fix page with SQL you can copy. Rescan after fixing.

In our test it was the only tool that found database holes (3 of 10): a table with RLS off, a view exposing user emails, and a function anyone could call. Our pick, 76/100.

Connect your repo to a free code scanner such as Aikido’s free plan, or run Semgrep Community Edition on your own machine if you’d rather not share your code.

Aikido’s free plan caught the most of any tool: 4.5 of 10 (leaked keys, the XSS and the vulnerable package). Runner-up, 66/100. Semgrep CE caught both leaked keys.

Policies should compare auth.uid() to the row’s owner column. A policy that says using (true), or only checks the authenticated role, lets every user see everyone’s rows.

TestCreate a second test user, sign in as them, and try to read or edit the first user’s rows. It should fail.

All six tools missed this one.

Keep “Verify JWT” on. Inside the function, use the caller’s token rather than the service-role key, so RLS still applies.

TestCall each function with no login (open its URL, or curl with no Authorization header). It should refuse.

All six tools missed this one. One even reported that API routes required auth when ours didn’t.

Make buckets private unless their files are truly public. Remove select or insert policies on storage.objects that are open to anon.

TestWhile signed out, try to list the bucket and upload a file. Both should fail.

Only one tool half-flagged this, with the wrong fix.

Search your code for dangerouslySetInnerHTML, innerHTML and v-html. Anything a user typed should be rendered as text.

TestSave a note containing <img src=x onerror=alert(1)>. No alert should pop up.

Only one tool of six caught this.

Run npm audit and update what it flags. Go by npm audit rather than a scanner’s suggested version.

Only one tool of six flagged our outdated package, and its suggested version still had advisories.

With RLS off, anyone with your project URL and public key can read, edit and delete every row, per Supabase’s docs.

We confirmed it on our test app: an anonymous request read and added notes.

The anon or publishable key is meant to be public. The service_role or secret key bypasses RLS and must never reach the browser. If one ever shipped, rotate it: deleting the line isn’t enough, it stays in git history.

Three tools found our planted service-role key; GitHub’s push protection blocked the committed .env.

Views and SECURITY DEFINER functions in the public schema can leak user emails or let anyone act on other users’ data.

Security Advisor flagged both in our test.