Anything + Supabase
Monitor the Supabase project behind your Anything app
Every Anything project gets a built-in Postgres database on Neon. Supabase is optional: Anything's docs say to use Functions to connect to an external database like Supabase. The risk sits in those Functions, because one that holds a secret key and skips its own checks gives every caller full access. Supahound watches that Supabase project's traffic and flags service-key misuse and bulk reads.
Last updated
Anything works with Supabase when you connect it yourself.
What are the Supabase security risks in Anything apps?
Functions that hold a secret key and check nothing
The documented Supabase path in Anything runs through Functions, so a Function usually holds the Supabase key. A sb_secret_ or service_role key bypasses RLS. A Function that forwards any request with that key returns any row to any caller.
Functions anyone can call
A Function that proxies Supabase reads or writes and does not require a signed-in user turns your database into a public API. Check who can call each Anything Function before you publish.
Supabase tables created by SQL without RLS
Anything documents no RLS generation or security scan for Supabase. Tables you or an agent create in the Supabase project with SQL start with RLS off, and Security Advisor rates that ERROR as lint 0013.
How does Supahound protect your Anything app?
- The service-key detector alerts from day one when your secret key is used from a browser or a new network, which is what a key copied out of a Function looks like.
- After a 7-day learning period, the scraping and bulk-export detector flags an actor reading far more rows than its usual pattern.
- The free posture scan checks RLS coverage and Security Advisor findings in the Supabase project, separate from Anything's built-in database.
- Database tampering alerts run from day one, so unexpected writes and deletes in the Supabase project surface without a learning period.
Frequently asked questions
- Does Anything use Supabase by default?
- No. Each Anything project gets a built-in PostgreSQL database on Neon, plus Functions and user accounts. You connect Supabase yourself through Functions. Supahound monitors only the Supabase project, not the built-in database.
- Is a Supabase key safe inside an Anything Function?
- A Function keeps the key off the client, which is the right place for it. A secret key still bypasses RLS there, so the Function must check who is calling and what they may read before it touches Supabase.
- Do I need Supahound if I only use Anything's built-in database?
- No. Supahound reads Supabase projects only. If your Anything app keeps everything in its built-in Neon database, there is nothing for Supahound to watch. It applies once a Function connects to Supabase.
- Were Anything apps in the Escape.tech vibe-coding study?
- Escape.tech's October 2025 scan of 5,600+ vibe-coded apps included about 449 Create.xyz apps and reported 2,000+ vulnerabilities and 400+ exposed secrets overall. The article does not break findings out per platform, so it is a reason to check your own app, not a verdict on Anything.
Watch your Anything app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.