Hosted Supabase: Supported method for hardening supabase_admin default ACLs?

[hamzarahbyy-bot]

Hello,

We are preparing a production security release for a hosted Supabase project.

Our security audit is complete and all local rehearsals pass.

The only remaining blocker concerns future default privileges owned by the internal supabase_admin role.

We verified that the hosted postgres role cannot execute:

SET ROLE supabase_admin;
-- ERROR: 42501

ALTER DEFAULT PRIVILEGES FOR ROLE supabase_admin ...;
-- ERROR: 42501

We understand that supabase_admin is a platform-managed role and that hosted postgres is not a PostgreSQL superuser.

Our question is:

What is the officially supported way to guarantee secure default privileges for future objects in a hosted Supabase project?

Specifically:

1. Is there a supported mechanism (Dashboard, CLI, migration, API, or support-assisted process) that executes as the real supabase_admin?

2. Or is the recommended model simply:

   • secure all existing objects with RLS and grants,
   • create all future user objects as postgres,
   • and ignore supabase_admin default ACLs because they are platform-managed?

We are intentionally avoiding unsupported role escalation or managed-schema modifications.

Any official guidance would be appreciated.

Thank you.