# Build Secure Supabase Backends

Supabase projects can expose data when RLS, storage, and realtime rules are incomplete. This skill provides reusable security patterns, migrations, client examples, and review checklists.

## Install

```bash
npx skillstore add consiliency/supabase-patterns
```

## Metadata

- Status: approved
- Slug: consiliency-supabase-patterns
- Skillstore revision: r1
- Version status: missing
- Tree hash: 4bda1b1317ed62b2ca1b04bb42c6f8ba510d8e9df791d1885c85e0d3f9c15ef6
- Author: Consiliency
- GitHub username: Consiliency
- License: MIT
- Repository: https://github.com/Consiliency/treesitter-chunker/tree/main/.ai-dev-kit/skills/supabase-patterns
- Ref: 635f69fb8d2f4e6330ba47a4e5a0fb239c04d110
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/consiliency-supabase-patterns
- Manifest: https://skillstore.pages.dev/api/skills/consiliency-supabase-patterns/manifest

## Capabilities

- Explains how to enable and force Row Level Security on Supabase tables.
- Provides ownership, public-read, team, role, soft-delete, and time-based policy examples.
- Shows typed Supabase client initialization, queries, inserts, and generated database types.
- Demonstrates realtime subscriptions with explicit cleanup.
- Illustrates user-scoped storage paths and public URL retrieval.
- Supplies migration structure, policy testing steps, and production security checklists.

## Use Cases

- Design Application Policies: Create ownership or team-based RLS policies for a new Supabase feature.
- Review Database Access: Compare existing policies against common mistakes and production security checks.
- Standardize Supabase Migrations: Establish repeatable migration, type-generation, and policy-testing conventions across services.

## Prompt Templates

### Add Basic Ownership

```
Create Supabase RLS policies for a posts table. Users may select, insert, update, and delete only rows matching their authenticated user ID.
```

### Design Team Access

```
Design RLS for posts and team_members. Members may read team posts, while team administrators may update them. Include assumptions and policy tests.
```

### Audit Existing Policies

```
Review these Supabase tables and policies for missing RLS, unsafe USING clauses, missing WITH CHECK clauses, and excessive realtime exposure: [paste schema and policies].
```

### Plan a Secure Migration

```
Produce a migration plan for this Supabase schema change: [describe change]. Cover RLS, storage, realtime, rollback, role tests, and generated client types.
```

## Limitations

- The guidance is generic and does not inspect a deployed Supabase project automatically.
- Referenced realtime and storage cookbook files are absent from this package.
- Examples use placeholder tables, claims, and identifiers that require project-specific adaptation.
- The package includes no automated policy tests or deployment safeguards.

## Best Practices

- Enable RLS when each table is created, then test every operation with realistic user roles.
- Keep schema and policy changes in reviewed migrations with a rollback plan.
- Use anonymous keys in clients and reserve service-role credentials for protected server environments.

## Anti Patterns

- Do not rely on client-side filters as a substitute for Row Level Security.
- Do not use USING alone for inserts or updates that require ownership validation.
- Do not expose service-role keys, sensitive columns, or unrestricted storage buckets to clients.

## Security Audit

- Audited at: 2026-07-13T17:31:00.994\+00:00
- Summary: All 44 static findings are false positives caused by SQL identifiers, Markdown code fences, template literals, or public Supabase client configuration. However, two cookbook examples define privileged functions without a fixed search path, creating a conditional privilege-escalation risk.

## Stats

- Views: 293
- Downloads: 10
- Favorites: 0
- Popularity score: 0