Security review of an AI-built Supabase app

A security review of an AI-built Supabase app looks first for one problem: a Supabase key in the frontend code, with the app talking straight to the database. It works in a demo. For an app with real customers and their data, it isn’t secure enough. The fix is a revamp: your own API in between, with every endpoint secured.

Many AI app builders set Supabase up this way, and everything else in the app is built on top of it.

Why it’s a problem

• The key is in the code every visitor downloads.
• The frontend talks to the database directly. The only thing between a visitor and your data is the database’s access rules.
• Those rules have to be right on every table, for every action. One missing or loose rule exposes data.
• Rules about prices, limits and who can do what sit in the browser, where the person using it can change them.

The fix is a revamp, not a patch

• Your own API sits between the app and the database. The app talks only to the API.
• Database keys move to the server, out of the frontend.
• Every API endpoint is secured. Each one checks who is calling and what they’re allowed to do. None can be called without the right login.
• Business rules move to the server.
• Keys for other services, like email, SMS and payments, stay on the server too.

This is a bigger change than fixing a few settings. It’s why I usually rebuild these apps rather than patch them. The prototype still has real value: it shows exactly what the app should do and look like.

What I check in a review

• Is there a database key in the frontend code, and what can it reach?
• Does the frontend talk to the database directly?
• Is every API endpoint secured?
• Are prices, limits and roles enforced on the server?
• Can one user see or change another user’s data?
• Are other secrets kept on the server?

I write up what’s exposed, in order of risk, and what fixing it involves.

For a check of the whole app, not just the database, see a security audit for your vibe-coded app.

FAQ

What do I get from a review? A written list of what’s exposed, in order of risk, and what fixing each item involves.

Do I have to stop using Supabase? Not necessarily. Supabase can stay as the database. The change is that only your server talks to it, not the app in the browser.