How to secure a Bolt.new app's Supabase database

How do I connect Supabase to Bolt.new?

New Bolt projects use a Bolt Database by default. Supabase is an option on the Pro and Teams plans. You can also claim a Bolt Database into your own Supabase organization later.

1. Open Account settings > Applications > Supabase > Connect.
2. Log in to Supabase and authorize Bolt. One Bolt account connects to one Supabase organization.
3. Choose Supabase when you start a project, or select or create a Supabase project for an existing one.

Which tables need RLS in a Bolt project?

All of them. Bolt turns on RLS for the tables it creates in Bolt Cloud and tells you to turn it on for tables you add. For a connected Supabase project its docs say nothing, so list the tables without RLS and fix each one.

-- Tables in public without RLS. This must return no rows.
select c.relname
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;

alter table public.orders enable row level security;

create policy "orders: owner reads" on public.orders
  for select to authenticated
  using ((select auth.uid()) = user_id);

create policy "orders: owner inserts" on public.orders
  for insert to authenticated
  with check ((select auth.uid()) = user_id);

create policy "orders: owner updates" on public.orders
  for update to authenticated
  using ((select auth.uid()) = user_id)
  with check ((select auth.uid()) = user_id);

How do I find always-true policies?

Bolt's database security check raises "RLS Policy Always True" for a policy that lets every row through. On a connected Supabase project, find them with a catalog query and replace each one with a policy that compares the row's owner with the caller.

-- Policies that pass for every row.
select tablename, policyname, cmd, roles
from pg_policies
where schemaname = 'public'
  and (qual = 'true' or with_check = 'true');

-- Replace an always-true policy with an owner check.
drop policy "orders: anyone updates" on public.orders;

create policy "orders: owner updates" on public.orders
  for update to authenticated
  using ((select auth.uid()) = user_id)
  with check ((select auth.uid()) = user_id);

How should a Bolt edge function check its caller?

Bolt's docs flag edge functions as the complex part of a project because they connect services and handle authentication. Supabase requires a valid JWT for each call by default. Keep that default, and inside the function check that the user may do what the request asks.

• Leave verify_jwt on unless the function is a webhook that verifies its own signature.
• Use the caller's identity from the JWT, never a user ID sent in the request body.
• Keep secret keys in the function's environment, never in the frontend.

# Functions that anyone can call without a signed-in user.
grep -n "verify_jwt = false" supabase/config.toml

What should I run before publishing a Bolt app?

1. Run the Database security check (all plans). Fix any missing RLS policy and any "RLS Policy Always True" warning.
2. On a paid plan, run the Security Audit from the Publish menu. It reviews code and database for data access, sign-in, key exposure and misuse, up to 30 times per day.
3. On a connected Supabase project, run the Supabase Security Advisor and the RLS query above.
4. Search the project for a secret key with the command below.

# Look for a secret key before you deploy. This must print nothing.
grep -rnE "sb_secret_|service_role" --exclude-dir=node_modules . 2>/dev/null

What changes when I claim a Bolt Database into Supabase?

The database moves into your own Supabase organization, where you manage it like any other project. On a Supabase Free plan account, Bolt's docs say leaked-password protection turns off, so check your Auth settings after the claim. A claimed project is also one you can authorize Supahound to watch.