Supabase Production & RLS Security Pack

Summary

Anyone with the publishable key from your website could read, change or delete every profile (including is_admin), write any invoice, and read every customer's totals through the view. Fixed with one migration, proved with pgTAP, re-audited clean.

Audit (real output, trimmed)

$ node audit-rls.mjs "$SUPABASE_DB_URL"
Exposed schemas audited: public

HIGH (3)
  [policy_allows_all_writes] public.invoices policy "Enable all for users"
      Permissive all policy for public with WITH CHECK (true): any row can be written
  [rls_disabled] public.profiles
      RLS is off. Client roles can reach every row: anon:select, anon:insert, anon:update, anon:delete, ...
  [view_bypasses_rls] public.invoice_summary
      View runs with its owner's rights, so RLS on its base tables does not apply.

Summary: 3 high, 2 medium, 2 low, 6 info

Fix migration

alter table public.profiles enable row level security;
revoke all on table public.profiles, public.invoices from anon, authenticated;
grant select, update (full_name) on table public.profiles to authenticated;
grant select on table public.invoices to authenticated;

create policy "profiles_select_own" on public.profiles for select to authenticated
  using ((select auth.uid()) = id);
create policy "profiles_update_own" on public.profiles for update to authenticated
  using ((select auth.uid()) = id)
  with check ((select auth.uid()) = id);

drop policy "Enable all for users" on public.invoices;
create policy "invoices_select_own" on public.invoices for select to authenticated
  using ((select auth.uid()) = user_id);
create index invoices_user_id_idx on public.invoices using btree (user_id);

alter view public.invoice_summary set (security_invoker = true);
revoke all on public.invoice_summary from anon, authenticated;
grant select on public.invoice_summary to authenticated;

Invoices become read-only for customers (the billing backend writes them with the secret key), and the column grant lets users rename themselves but not set is_admin.

Proof

set local role authenticated;
set local request.jwt.claims = '{"sub": "22222222-2222-2222-2222-222222222222", "role": "authenticated"}';
select is_empty($$select * from public.invoice_summary$$, 'other user sees no totals through the view');
select throws_ok($$update public.profiles set is_admin = true$$, '42501', null, 'user cannot make themselves admin');

$ supabase test db
All tests successful.  Files=1, Tests=5  Result: PASS
$ node audit-rls.mjs "$SUPABASE_DB_URL"
Summary: 0 high, 0 medium, 0 low, 5 info

Next steps

• Run scan-key-leaks.mjs over the production build.
• Review Auth URLs and SMTP, Edge Function verify_jwt, bucket settings and backups.