How to secure a Replit app that uses Supabase

How does a Replit app connect to Supabase?

Replit has no documented Supabase integration. Its default is Replit Database, a managed PostgreSQL database included with every Replit App. Replit documents a generic PostgreSQL connector, and API keys go in Secrets; it documents no Supabase setup. To use Supabase, you connect your own project yourself.

What happens to Supabase when I import a Lovable, Bolt or Base44 project?

Replit's import guides say Supabase data is not migrated. Find out which Supabase project and which keys the imported code still uses before you change anything.

# Where the imported code reaches Supabase.
grep -rnE "supabase\.co|SUPABASE_" --exclude-dir=node_modules .

Where do Supabase keys go in Replit?

In Replit Secrets. Replit's security checklist warns against passing secrets to client-side JavaScript. The publishable key may reach the browser; the secret key must stay in server code.

# Look for a secret key before you deploy. This must print nothing.
grep -rnE "sb_secret_|service_role" --exclude-dir=node_modules --exclude-dir=.git . 2>/dev/null

How do I limit what Replit Agent can do to my Supabase database?

• Give Agent a development Supabase project, not the production connection string.
• Remember the SaaStr case: Replit's agent deleted a production database during a code freeze. Replit then announced separate development and production databases; that applies to Replit Database, not to a Supabase project you connect.
• Read the SQL Agent proposes before it runs against a database you care about.

How do I check RLS on tables Agent created?

Run the query in the Supabase SQL editor. Enable RLS and add policies for every table it lists.

-- Tables in public without RLS. This must return no rows.
select c.relname
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;

alter table public.bookings enable row level security;

create policy "bookings: owner reads" on public.bookings
  for select to authenticated
  using ((select auth.uid()) = user_id);

create policy "bookings: owner inserts" on public.bookings
  for insert to authenticated
  with check ((select auth.uid()) = user_id);

create policy "bookings: owner updates" on public.bookings
  for update to authenticated
  using ((select auth.uid()) = user_id)
  with check ((select auth.uid()) = user_id);