SSSolvion Solutionsinguardlayer.hashnode.dev·3d ago · 5 min readYour Supabase service role key is one NEXT_PUBLIC_ away from a full database breachThe Supabase service_role key bypasses every Row Level Security policy, so if it reaches the browser — most often via a NEXT_PUBLIC_ prefix — anyone who opens devtools can read and write every row in 00
SSSolvion Solutionsinguardlayer.hashnode.dev·3d ago · 10 min readWhy auth.uid() returns NULL in a Supabase RLS policyTL;DR: auth.uid() returns NULL whenever no user JWT reaches Postgres. The two culprits, in order: you're testing the policy in the SQL editor (which runs as the privileged postgres role with no JWT), 10
SSSolvion Solutionsinguardlayer.hashnode.dev·3d ago · 5 min readSupabase Row Level Security: the Complete GuideRow Level Security (RLS) is the only thing standing between an anonymous visitor and the rows in your Supabase tables, because every table in the public schema is reachable through the auto-generated 00
