Confirm RLS is enabled everywhere it matters
Inventory every table exposed through the Data API. A strong policy on five tables does not protect the sixth table that was added during a late feature sprint.
Test as an anonymous user and as a normal authenticated user. Do not rely on what the application interface displays.
- List exposed schemas and tables
- Verify RLS is enabled on each exposed table
- Test SELECT, INSERT, UPDATE and DELETE separately
- Confirm views and functions do not bypass the intended boundary
Test ownership with two accounts
Create two ordinary users in separate organizations. Capture a record identifier from account A and replay the same request while authenticated as account B.
Repeat the test for nested resources such as invoices, projects, files and comments. A child table can expose data even when the parent table is protected.
- Replace record IDs in URLs and request bodies
- Try filters that reference another owner
- Attempt bulk updates and deletes
- Test organization invitations and membership changes
Protect fields that control privilege
A policy may correctly limit a user to their own row while still allowing them to change the row’s owner_id, organization_id, role, balance or subscription status.
Field-level business rules often need triggers, functions or carefully constrained update policies rather than a broad ownership check.
- Attempt to change role and organization fields
- Attempt to write credit, balance and plan fields
- Confirm immutable ownership values remain immutable
- Recheck server functions that run with elevated privileges
Review storage and privileged keys
Storage policies require the same ownership discipline as database records. Test object listing, guessing paths, replacing files and deleting another user’s object.
The anon key is intended for public clients. The service-role key is privileged and must never be included in browser bundles or public logs.
- Test private buckets while logged out
- Try another user’s object path
- Search deployed JavaScript for the service-role key
- Limit privileged operations to trusted server environments
Authoritative references
Have experienced reviewers test the real application.
AuditFlare validates findings across your product, code and business logic, then explains what to fix.
Explore the Supabase security audit →