How to secure a Softgen + Supabase app

How does Softgen connect to Supabase?

By default Softgen manages the backend: it creates a Supabase project and configures the credentials. Advanced users connect their own Supabase project with three environment variables.

• NEXT_PUBLIC_SUPABASE_URL: the project URL. Public.
• NEXT_PUBLIC_SUPABASE_ANON_KEY: the anon key. Public, and safe only when RLS is right.
• SUPABASE_SERVICE_ROLE_KEY: bypasses RLS. Server only. Never add the NEXT_PUBLIC_ prefix.

Which Softgen variables reach the browser?

Next.js ships every variable that starts with NEXT_PUBLIC_ to the browser. Build the app, then search the client output for a service role or secret key.

# Look for a secret key before you deploy. This must print nothing.
grep -rnE "sb_secret_|service_role" .next/static/ 2>/dev/null

How do I check RLS in a Softgen project?

Run the first query in the Supabase SQL editor. It lists tables in public without RLS. Enable RLS on each and add policies; the second block shows an ownership set for a table with a user_id column.

-- Tables in public without RLS. This must return no rows.
select c.relname
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;

alter table public.invoices enable row level security;

create policy "invoices: owner reads" on public.invoices
  for select to authenticated
  using ((select auth.uid()) = user_id);

create policy "invoices: owner inserts" on public.invoices
  for insert to authenticated
  with check ((select auth.uid()) = user_id);

create policy "invoices: owner updates" on public.invoices
  for update to authenticated
  using ((select auth.uid()) = user_id)
  with check ((select auth.uid()) = user_id);

How should Softgen server code use the service role key?

• Use it only in server code: Route Handlers, Server Actions or background jobs.
• Check the signed-in user before every query that uses it. The key skips RLS, so the check is all there is.
• Prefer the user's session with the anon key when a user reads their own data, so RLS applies.
• Rotate the key if it ever appears in a client bundle, a log or a public repo.

What should I check before deploying a Softgen app?

1. Run the RLS query above. It must return no rows.
2. Run the Supabase Security Advisor and fix every ERROR-level finding.
3. Search the client build for secret keys.
4. After deploying, run the free /hack-me scan on your domain.