Hosting and deploy

What is Supabase?

Supabase is an open-source backend on PostgreSQL with auth, storage, realtime and functions. How it works, why vibe coders use it, and what to secure first.

Supabase is an open-source backend platform built on PostgreSQL. It gives you a hosted database with an automatic API, authentication, file storage, realtime updates and edge functions, so a frontend can work without its own server. Many AI app builders use it by default. Its security depends on row level security policies that you must write.

Published 9 November 2026 · Last updated 9 November 2026

By Michal Měřínský. Audit methodology.

What Supabase includes

Database: a full PostgreSQL database, with SQL, extensions, and a table editor.
API: an automatic REST and GraphQL API over your tables, used by the supabase-js client.
Auth: sign-up and login with email, magic links, phone and OAuth providers.
Storage: files in buckets, with access rules.
Realtime: live updates when rows change.
Edge Functions: server-side TypeScript functions for logic and secret API calls.

How apps talk to it

Your frontend uses the supabase-js client with your project URL and a publishable key, historically called the anon key, which is designed to be public. Every request runs as the signed-in user, or as anonymous, and PostgreSQL decides what that user may read or change using row level security policies.

const { data } = await supabase.from("projects").select("*");

The security rule that matters most

A table without row level security, RLS, is readable and often writable by anyone holding the public key, which is anyone who opens your site. Enable RLS on every table in an exposed schema and write policies:

alter table projects enable row level security;
create policy "owners read" on projects
  for select using (auth.uid() = owner_id);

Never use the secret or service role key in frontend code. It bypasses RLS completely.
Check the Security Advisor in the Supabase dashboard, which flags tables without RLS.

AI app builders often create tables quickly and leave policies for later. Before launch, list every table and confirm RLS is on with a policy for each operation you allow.

Why vibe coders use it

Supabase removes the need to build and host a backend for a first version: tools such as Lovable, Bolt and v0 can create tables, auth and storage for you. The trade-off is that access control moves into database policies, which are easy to skip and hard to see from the frontend.

What a scan can and cannot tell you

WebAuditOS checks your site's public side: CORS settings, Content Security Policy and cookie flags.

It cannot see your Supabase project, whether RLS is enabled, or what your policies allow. Use Supabase's Security Advisor and test with the public key as an anonymous user.

The fastest RLS test: open your site logged out, copy the public key from the network panel, and try to read each table. Anything you can read, anyone can.

Short answers

Is Supabase a database? It is a backend platform built around a PostgreSQL database.

Is Supabase free? It has a free plan with limits, and paid plans from 25 dollars a month.

Is the anon key safe in my frontend? Yes, if RLS is enabled with correct policies. Without RLS, no.

Is Supabase open source? Yes, and it can be self-hosted.

In the product

The checks this maps to

Every check named here runs on every scan, on every plan - what a plan changes is how many pages are crawled, how long the history is kept and what you can do with the result. These are the ids the findings carry, so you can match a line in a report to the explanation above.

sec.cors.wildcard - CORS is not wide open
sec.headers.csp - Content-Security-Policy header
sec.cookies.secure - Cookies set with the Secure flag

Run a free audit See a full sample report See the whole check library