Security Checklist for Next.js + Supabase | BeforeMerge | BeforeMerge

Pricing Blog Contributors Install Guide

Explore
Next.js + Supabase Standards
Security Checklist for Next.js + Supabase

ReferenceNext.js + Supabase Standards

Security Checklist for Next.js + Supabase

Share

Environment variable management, SSRF prevention, input validation, rate limiting, CSP headers, and service role key protection.

Tags

nextjssupabase

Related

Database Migration Best Practices for Supabase

The Three Supabase Clients — When to Use Each

RLS Policy Design Patterns for Multi-Tenant Apps

Server Components vs Client Components — The Decision Framework

Explore more rules and knowledge

BeforeMerge offers hundreds of code review rules, guides, and detection patterns to help your team ship better code.

Join Waitlist Browse All

On this page

Environment Variables
Supabase
Server Actions
Web Security
Dependencies

AI-native code review knowledge base. Structured rules that catch what linters miss.

Product

Features
Explore
Pricing
Docs
GitHub

Company

About
Blog
Contributors
Contributing

Legal

Privacy Policy
Terms of Service
MIT License

© 2026 BeforeMerge. Built by

Features Explore

Rules Skills Knowledge Prompts

Pricing Blog Contributors Install Guide

Security Checklist

Environment Variables

Service role key is NOT in NEXT_PUBLIC_ vars
.env.local is in .gitignore
.env.example has all required vars (no values)
No secrets hardcoded in source code
Secrets not logged in error messages

Supabase

RLS enabled on ALL tables
No USING (true) on private tables
is_org_member() helper used consistently
Admin client used only for writes with requireAuth()
Generated types used for query safety

Server Actions

requireAuth() is first call in every action
All inputs validated with Zod
organization_id explicitly set on all mutations
Error messages don't expose internals

Web Security

CSP headers configured
SSRF protection on user-provided URLs
Rate limiting on public endpoints
HTTPS-only cookies for sessions
server-only package used on sensitive modules

Dependencies

Dependencies pinned to exact versions
npm audit runs in CI
No known vulnerabilities in production deps