Hey everyone,

We just published our 2025 Supabase Security Best Practices Guide, based on findings and common misconfigurations we’ve seen during recent pentest engagements.

It’s a rolling article that we plan to keep updating over time as new issues come up — we still have a few more findings to post about, but wanted to share what we’ve got so far.

If you’re running Supabase in production (or planning to), it might help you double-check RLS, Edge Functions, Vault, and other areas where we often see mistakes.

Happy to hear feedback, and we’d love to know if you’ve run into similar issues.