2025 Supabase Security Best Practices Guide - Common Misconfigs from Recent Pentests.

[m0chan]

Hey everyone,

We just published our 2025 Supabase Security Best Practices Guide, based on findings and common misconfigurations we’ve seen during recent pentest engagements.

One example: we’ve found full-read SSRF through the http extension being exposed via RPC. In some setups, anon or authenticated roles had EXECUTE on network-capable functions, which meant we could hit /rest/v1/rpc/http_get and pull back arbitrary URLs through the database.

We’ve also seen common RLS missteps (like permissive policies or missing WITH CHECK), and Vault/secret helpers being reachable to end-user roles.

It’s a rolling article that we plan to keep updating over time as new issues come up — we still have a few more findings to post about, but wanted to share what we’ve got so far.

If you’re running Supabase in production (or planning to), it might help you double-check RLS, Edge Functions, Vault, and other areas where we often see mistakes.

👉 Supabase Security Best Practices (2025 Guide)

Happy to hear feedback, and we’d love to know if you’ve run into similar issues.