Softgen + Supabase
Monitor the Supabase project behind your Softgen app
Softgen apps run on Next.js and Supabase, and the own-project setup asks for three variables: the URL, an anon key that Next.js ships to browsers, and SUPABASE_SERVICE_ROLE_KEY. That last key bypasses RLS. Supahound watches the Supabase project you connect for that key showing up from a browser or a new network, and checks every table for RLS each day.
Last updated
Softgen has a built-in Supabase integration.
What are the Supabase security risks in Softgen apps?
A service role key one prefix away from the browser
SUPABASE_SERVICE_ROLE_KEY is part of Softgen's documented setup. Renamed with NEXT_PUBLIC_, or imported into a client component, it hands an RLS-bypassing key to every visitor.
Tables open to the browser's anon key
The setup puts NEXT_PUBLIC_SUPABASE_ANON_KEY in the browser on purpose. Any table without RLS answers that key, for any visitor who reads it from the page.
Server routes that trust the service role
Server code that holds the service role key skips every policy. Each route that uses it has to decide on its own whether the caller may see the data.
No documented security scan
Softgen's onboarding lists Row Level Security as built-in data protection, but it does not say Softgen writes policies and it documents no security scan. Finding RLS gaps falls to the Supabase Security Advisor.
How does Supahound protect your Softgen app?
- The service-key detector flags SUPABASE_SERVICE_ROLE_KEY used from a browser or a new network, from day one.
- The free daily posture scan adds the check Softgen does not document: RLS coverage, Security Advisor findings, views without security_invoker and newly exposed tables.
- The cross-tenant read detector flags a user whose reads cross tenant boundaries through a server route or a loose policy.
- After 7 days of learning, the scraping detector flags bulk reads through the anon key.
- The free /hack-me scan checks your Softgen domain for Supabase keys in public JavaScript once you prove DNS ownership.
Frequently asked questions
- Does Supahound work with Softgen's managed Supabase?
- By default Softgen creates a Supabase project and configures the credentials for you. Supahound watches projects in an organization you authorize, and Softgen's docs do not say you can authorize the managed one. If you bring your own project, Supahound can watch it.
- Does Softgen set up RLS for my tables?
- Softgen's onboarding page lists Row Level Security under built-in data protection. It does not say Softgen writes the policies. Run a catalog query or the Security Advisor to see which tables have RLS and which policies exist.
- Is it safe to give Softgen my service role key?
- The documented setup stores it as SUPABASE_SERVICE_ROLE_KEY. Without the NEXT_PUBLIC_ prefix, Next.js keeps it on the server. Keep that name, never import it into client code, and rotate it if it ever reaches the browser.
Watch your Softgen app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.