Explore

Tables with RLS enabled but missing policies for certain operations silently deny access. Ensure every table has policies for SELECT, INSERT, UPDATE, and DELETE. [CWE-862 · A01:2021]

supabaserls

Enable RLS on Every Table with Complete Policies

Every table must have Row Level Security enabled with at least one policy per operation. Tables without RLS are accessible to any authenticated user. [CWE-862 · A01:2021]

supabaserls

Use Migration Files Instead of MCP or Dashboard SQL

Schema changes via Supabase MCP, SQL editor, or dashboard don't create migration files. This causes schema drift between environments.

supabaseDatabase

Use getUser() Instead of getSession() for Auth Checks

getSession() reads from cookies and can be spoofed. getUser() verifies the token with the Supabase Auth server, making it tamper-proof. [CWE-287 · A07:2021]

sessionsupabase

Never Expose Service Role Key in Client-Side Code

Using NEXT_PUBLIC_ prefix on SUPABASE_SERVICE_ROLE_KEY or DATABASE_URL embeds secrets into client-side JavaScript bundles, bypassing all RLS. [CWE-798 · A07:2021]

nextjssupabase

Validate Input at Runtime with Zod Instead of Type Assertions

Using 'as' type assertions on external input (params, form data, request bodies) provides zero runtime safety. Use Zod for runtime validation. [CWE-20 · A03:2021]

supabaseValidation

Always Check Error Before Using Data from Supabase Queries

Destructuring { data } without checking { error } from Supabase queries ignores failures silently. When error is non-null, data is always null. [CWE-252]

supabasequality

Distinguish Not-Found from Other Supabase Errors

Treating all Supabase errors the same (if error, throw) hides whether a record is missing or the query itself failed. Check error codes for proper handling.

postgrestsupabase

Avoid select('*') — Request Only the Columns You Need

Using .select('*') fetches all columns including large text/json fields, wastes bandwidth, leaks data shape, and prevents index-only scans.

Queriessupabase

Avoid N+1 Queries with Supabase Relational Selects

Fetching parent records then looping to fetch children creates N+1 HTTP requests. Use Supabase nested .select('*, children(*)') to resolve in a single query. [CWE-400]

Queriessupabase

Add Indexes for Filtered and Ordered Columns

Filtering or ordering on unindexed columns causes full table scans. RLS policy columns like user_id and org_id especially need indexes. [CWE-405]

Queriessupabase

Use Cursor-Based Pagination Instead of Offset Pagination

Using .range() offset pagination for large datasets forces PostgreSQL to scan all skipped rows. Use cursor-based pagination with .gt()/.lt() for constant-time page fetches.

cursorQueries

Use Connection Pooling (Supavisor) for Serverless Deployments

Each serverless invocation opening a direct database connection exhausts PostgreSQL's connection limit. Use Supavisor pooler URLs for all serverless environments.

supabasesupavisor

Use Batch Operations Instead of Single-Row Loops

Inserting or updating rows one at a time in a loop creates N HTTP requests. Use .insert([...]) or .upsert([...]) to batch into a single request.

supabasebulk

Generate Database Types from Schema

Hand-writing TypeScript interfaces for database tables leads to drift between code and schema. Use supabase gen types to generate types automatically.

supabasetypes

Follow Canonical Migration File Structure

Migration files without proper structure (table, indexes, RLS, policies, comments) are harder to review and prone to missing critical steps like RLS.

supabaseDatabase

Use the Correct Supabase Client for Each Context

Using the wrong Supabase client for the context breaks RLS, leaks auth state, or causes hydration errors. Match client type to Next.js rendering context.

middlewarenextjs

Prevent Prototype Pollution from Untrusted Input

Spreading or Object.assign-ing untrusted user input into objects can pollute Object.prototype and lead to security bypasses. [CWE-1321]

ReactPrototype Pollution

Use Cryptographic Randomness for Tokens and IDs

Math.random() is not cryptographically secure. Use crypto.randomUUID() or crypto.getRandomValues() for tokens, IDs, and security-sensitive values. [CWE-338]

Reactrandomness

Never Use eval() or new Function() with User Input

Using eval(), new Function(), or innerHTML with user-controlled strings enables arbitrary code execution in the browser. [CWE-95 · A03:2021]

code-injectionReact

Sanitize Content Before dangerouslySetInnerHTML

Using dangerouslySetInnerHTML with unsanitized user input enables XSS attacks. Always sanitize with DOMPurify or a trusted library. [CWE-79 · A03:2021]

SanitizationXSS

Always Clean Up useEffect Side Effects

Missing cleanup in useEffect for subscriptions, timers, event listeners, and AbortControllers causes memory leaks, stale callbacks, and state updates on unmounted components.

useeffectReact

Never Use Array Index as Key for Dynamic Lists

Using array index as key in lists that can be reordered, filtered, or inserted into causes React to mismap state to the wrong items, creating subtle and hard-to-debug UI bugs.

key-propreconciliation

Add Error Boundaries Around Unreliable UI Sections

Without error boundaries, a single component crash unmounts the entire React tree. Wrap unreliable sections so failures are isolated and recoverable.

reliabilityReact