Emergent + Supabase
Monitor a Supabase project connected to your Emergent app
Emergent builds apps on MongoDB that it manages, with Emergent Auth and Emergent Storage. Supabase is not in its integrations catalogue. If you ask the agent to use your own Supabase project, Emergent's docs say it will attempt the setup with standard REST APIs or SDKs, with no Supabase-specific guardrails. Supahound scans that project's RLS daily and flags a secret key used from a browser.
Last updated
Emergent does not use Supabase by default. These pages apply when you connect your own Supabase project.
What are the Supabase security risks in Emergent apps?
A Supabase setup no platform check reviews
For services outside its catalogue, Emergent's docs say the agent will attempt to configure them using standard REST APIs or SDKs. Emergent documents no guardrails for that Supabase setup, so review the keys, tables and policies the agent touched yourself.
A secret key outside Emergent's runtime injection
Emergent injects integration secrets at runtime and says they are never exposed in logs or client-side code. A Supabase key placed where that injection does not apply, such as frontend code, ships to the browser, and a sb_secret_ key there bypasses RLS.
Agent SQL that leaves new tables open
If Emergent's agent creates Supabase tables in SQL, none of them get RLS by default. Security Advisor marks each one as an ERROR under lint 0013, because until you fix it anyone with your project URL can create, read, update and delete those rows.
How does Supahound protect your Emergent app?
- The free posture scan checks the Supabase project for RLS coverage, newly exposed tables and views without security_invoker.
- The service-key detector alerts from day one when a Supabase secret key is used from a browser or a new network.
- If your Emergent app serves several customers from one Supabase project, the cross-tenant read detector flags a user reading another tenant's rows.
- Alerts go out by email and signed webhook, and Supahound keeps 30 days of incident history.
Frequently asked questions
- Does Emergent support Supabase?
- Supabase is not in Emergent's integrations catalogue or on its MCP connectors page. Apps use MongoDB on a shared cluster that Emergent manages, with separate preview and production databases.
- Does Emergent's pre-publish health check cover Supabase?
- Emergent documents a pre-publish health check, but its docs do not describe checks on an external Supabase project. Run Supabase's Security Advisor on that project as well.
- Can I bring my own database to Emergent?
- Emergent supports bringing your own MongoDB Atlas. Supabase is not a listed option, so a Supabase connection is one the agent builds on request over REST or an SDK.
Watch your Emergent app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.