Firebase Studio + Supabase
Monitor a Supabase backend you added to a Firebase Studio app
Firebase Studio uses Firebase by default: when an app needs a database or sign-in, its App Prototyping agent sets up Cloud Firestore and Firebase Authentication. Supabase is not part of it. If you connect your own Supabase project, Firebase Security Rules do not protect it; Postgres RLS does. Supahound checks that project's RLS daily and watches its traffic for leaked keys and bulk reads.
Last updated
Firebase Studio does not use Supabase by default. These pages apply when you connect your own Supabase project.
What are the Supabase security risks in Firebase Studio apps?
Hand-added Supabase tables without RLS
Nothing in Firebase Studio creates Supabase tables for you, so every table comes from SQL you or the agent write. Tables made that way start with RLS off, and a public table without RLS lets anyone with the project URL read and change it.
Expecting Security Rules to cover Supabase
Firebase protects its own services with Security Rules, not Postgres RLS. Supabase does not read those rules. Each Supabase table needs its own policies, and once RLS is on it returns no rows through the API until a policy allows them.
A Supabase secret key in client code
Only the publishable key (sb_publishable_) belongs in a Firebase Studio app's client code. A sb_secret_ key maps to service_role, which has BYPASSRLS, so anyone who copies it from the bundle can read and write every table.
Supabase Edge Functions with JWT checks turned off
If you add Supabase Edge Functions alongside a Firebase Studio app, keep JWT verification on. A function deployed with --no-verify-jwt or verify_jwt = false can be invoked by anyone.
How does Supahound protect your Firebase Studio app?
- The free posture scan reports RLS coverage and newly exposed tables in the Supabase project every day.
- The service-key detector alerts from day one when a Supabase secret key is used from a browser or an unfamiliar network.
- If the app signs users in with Supabase Auth, the credential stuffing detector watches those sign-ins from day one.
- Supahound monitors only the Supabase project. It does not read Firestore or Firebase Authentication.
Frequently asked questions
- Does Firebase Studio support Supabase?
- Its docs do not mention Supabase. The App Prototyping agent sets up Cloud Firestore and Firebase Authentication when an app needs them. Supabase is something you connect yourself.
- Can I still start a new Firebase Studio workspace?
- No. Google's docs say new workspace creation and user signup are no longer supported. Existing workspaces still work.
- Do Firebase Security Rules protect a Supabase project?
- No. Security Rules apply to Firebase services. A Supabase project relies on Postgres Row Level Security, which you enable and write for each table.
Watch your Firebase Studio app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.