Same + Supabase
Monitor the Supabase project behind your Same app
Same connects to Supabase through the Supabase MCP server, then creates the project, designs the schema and runs the migrations from your prompts. Its docs do not mention RLS or a security scan, and Supabase does not turn RLS on for tables made with SQL. Supahound's free daily scan finds tables left open, and its paid detectors flag cross-tenant reads, scraping and tampering.
Last updated
Same has a built-in Supabase integration.
What are the Supabase security risks in Same apps?
A schema written through MCP-run SQL
Same designs the schema and runs the migrations through the Supabase MCP server. Tables made that way do not get RLS automatically, and Same's docs do not say it adds RLS.
Project-wide agent access
The Supabase card in Same's Tools panel authorizes the Supabase MCP server, which gives the agent access across the project. Supabase's MCP guide names prompt injection as the main LLM-specific attack on that kind of access.
No scan inside Same
Same's docs describe no security scan. Between prompts, nothing in Same reports a table that lost its RLS or a policy that lets everyone in; the Supabase Security Advisor is the check you have.
A secret key in client code
Same's docs do not say where it puts Supabase keys. A secret or service_role key in client code skips RLS for anyone who reads it, and Supabase's browser block does not stop a script that copied the key.
How does Supahound protect your Same app?
- The free daily posture scan reports RLS coverage, Security Advisor findings and newly exposed tables after each prompt that changes the schema.
- From day one, the cross-tenant read detector flags a signed-in user whose reads cross into other tenants' rows in a schema Same designed.
- The database-tampering detector needs no learning period, so it covers a Same app from the day you connect its project.
- If a secret key ends up in client code Same wrote, the service-key detector flags its use from a browser or an unfamiliar network.
- After 7 days of learning, the scraping detector flags bulk export of your tables.
Frequently asked questions
- Does Same turn on RLS for the tables it creates?
- Same's docs do not say. They describe Same creating the project, designing the schema and running migrations, with no mention of RLS. Run a catalog query after each schema change to check.
- Should I keep the Supabase MCP connection in Same?
- Same needs it to build the database. Supabase's MCP guide recommends scoping the connection to one project, using read-only mode for unattended routines and connecting to production only when a task needs it.
- Does Same have its own database?
- Same documents no built-in database. It connects Supabase or Neon through MCP. Supahound covers the Supabase case.
Watch your Same app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.