Supabase monitoring
Supabase security monitoring: catch abuse in your project's traffic
An attacker needs no exploit to read a Supabase table without RLS: Supabase's own lint says anyone with the project URL can create, read, update and delete its rows. Supahound connects with read-only OAuth, runs a free daily posture scan of RLS and Security Advisor findings, and on paid plans reads your edge logs every 1–2 minutes to flag abuse per actor.
Last updated
What attacks hit Supabase apps?
Cross-tenant reads through a wrong RLS policy
RLS is only as strict as its policies. A policy that never compares the row's owner with the caller lets every signed-in user read every row. Security Advisor lint 0024 flags permissive policies, but a policy can pass the lint and still check the wrong column.
A leaked secret or service_role key
Secret keys (sb_secret_) map to service_role, which has BYPASSRLS. Supabase rejects a secret key sent from a browser with HTTP 401 by checking the User-Agent, so a key copied into a script or a server still works. Legacy service_role JWT keys are deprecated by the end of 2026.
Credential stuffing on Supabase Auth
The publishable key is safe to expose, so anyone can send sign-in requests to your project with it. An attacker replays leaked email and password lists against Auth, and each match is a taken-over account with that user's RLS rights.
Scraping through the REST API
On existing projects, new public tables grant anon and authenticated full table privileges unless you revoke them. Any client that holds the public key can page through every row a policy allows, and Escape.tech found anonymous Supabase JWTs in front-end bundles.
Tables and views exposed without RLS
Tables made in the Table Editor get RLS automatically; tables made with SQL or migrations do not. Views are created as security definer and skip RLS unless set to security_invoker=on. Lints 0013 and 0010 flag both at level ERROR.
How does Supahound protect your Supabase project?
- The free daily posture scan covers up to 3 projects: RLS coverage, Security Advisor findings, views without security_invoker and newly exposed tables.
- The cross-tenant read detector flags an actor whose reads cross tenant boundaries, from the first day.
- The service-key detector flags a secret or service_role key used from a new network or from a browser.
- The credential-stuffing and database-tampering detectors alert from day one. The scraping and bulk-export detector learns each project's traffic for 7 days first.
- Each finding joins an incident with a plain-English summary and a paste-ready SQL fix, sent by email or signed webhook and kept for 30 days.
Frequently asked questions
- Does Supabase have built-in security monitoring?
- Supabase ships the Security Advisor, which lints your schema and configuration. Lint 0013 flags public tables without RLS and lint 0010 flags security definer views. Supahound's free posture scan includes those findings and adds per-actor detection on your edge logs.
- Does Supahound need my service_role key?
- No. Supahound never asks for a service_role or secret key. You authorize a Supabase organization through OAuth with three read-only scopes: analytics:read, database:read and projects:read.
- Can Supahound block an attack on my Supabase project?
- No. Supahound detects and does not block. It groups findings into incidents, explains each one in plain English and gives you SQL to paste into your project. You apply the fix.
- How much does Supabase monitoring with Supahound cost?
- The posture scan is free for up to 3 projects. Runtime detection costs $29 per project per month on Builder, or $19 per project per month on Agency with a 10-project minimum.
Find out if someone is abusing your app
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.