How to connect Supabase to Anything without opening your data

When does an Anything app need Supabase?

Often it does not. Anything's built-in database runs on Neon Postgres and comes with Functions and user accounts. Connect Supabase when you already run a Supabase project or need its features.

Anything's docs describe one Supabase path: Functions that connect to the external database. They do not document calling Supabase from the client, so this guide assumes all Supabase traffic goes through Functions.

Which Supabase key should an Anything Function use?

• Anything has its own user accounts. Unless your app signs users in with Supabase Auth, Supabase RLS cannot tell them apart, and the Function's own checks are the access control.
• A secret key (sb_secret_) maps to service_role, which has BYPASSRLS. Every Function that holds one must check the caller itself.
• Keep RLS on with no anon policy anyway. If the project URL or publishable key leaks, the tables stay closed.
• Store the key with the Function, never in client code.

What must every Function check before it touches Supabase?

• The caller is signed in. Reject anonymous calls unless the data is public.
• The caller owns, or may see, the rows the Function returns.
• The Function takes no table name, column list or raw filter from the request.
• The Function limits how many rows one call can return.

How do I enable RLS in the Supabase project?

Turn RLS on in the same SQL that creates each table. With RLS on and no policy, the API returns nothing to the anon and authenticated roles, which is the safe default when only Functions read the data.

create table public.bookings (
  id uuid primary key default gen_random_uuid(),
  guest_id uuid not null references auth.users (id) on delete cascade,
  starts_at timestamptz not null
);
alter table public.bookings enable row level security;

create policy "bookings: guest reads" on public.bookings
  for select to authenticated
  using ((select auth.uid()) = guest_id);

create policy "bookings: guest creates" on public.bookings
  for insert to authenticated
  with check ((select auth.uid()) = guest_id);

What should I check before publishing an Anything app?

1. Call each Function while signed out. Every one that touches private data must refuse.
2. Call each Function as user A and ask for user B's rows. It must return nothing.
3. Run the RLS-off query in the Supabase SQL Editor and expect zero rows.
4. Open Security Advisor and fix every ERROR.

-- Every table in public without RLS. Expect zero rows.
select c.relname
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;