Securing Next.js + Supabase, in depth
The specific mistakes that get apps on this stack hacked — and the exact fix for each. No generic checklists.
- ·8 min read
Fix: permission denied for schema auth (Supabase 42501)
What 'permission denied for schema auth' and 'for table users' mean in Supabase, why granting access is the wrong fix, and the fix that keeps emails private.
SupabaseAuthPostgresGrantsSecurity - ·7 min read
Fix: permission denied for view (Supabase 42501)
The calling role has no SELECT grant on the view. Since Oct 30, 2026, new views need one. Set security_invoker first, or the grant hands out every row.
SupabasePostgresGrantsRLSData API - ·7 min read
Firestore test mode expired? Don't fix it with if true
When Firestore's test-mode rules expire, every client request fails. The quick fixes (if true, a new date) reopen your whole database. Here is the real fix.
FirebaseFirestoreSecurity RulesData Leak - ·7 min read
Failed to find Server Action "x": what that log line means
A Next.js log line naming Server Action "x" is a React2Shell scanner probe. Only versions below the current patch floor log it that way. Upgrade next.
Next.jsServer ActionsCVEDependenciesLogging - ·7 min read
"Only async functions are allowed" in use server: safe fix
This Next.js error means a "use server" file exports something that isn't a function. Move it out of the file; wrapping it in async makes a public action.
Next.jsServer ActionsSupabaseSecurity - ·7 min read
Edge Function returned a non-2xx status code: real error
"Edge Function returned a non-2xx status code" hides the real error. Read the status and body from error.context, then fix the cause, not the auth check.
SupabaseEdge FunctionsAuthDebugging - ·13 min read
Supabase Security Advisor: every warning explained
Every Supabase Security Advisor lint: its number, title, level and what it means, with a fix guide for each, plus the ones you can catch before deploy.
SupabaseSecurity AdvisorPostgresRLSSecurity - ·8 min read
Supabase 'Unrestricted' table: what the red badge means
Supabase's red Unrestricted badge means a table has RLS off while anon or authenticated can SELECT it. Decode every tooltip and find the right fix.
SupabaseRLSStudioData APIGrants - ·7 min read
Supabase vulnerabilities: 4 real CVEs vs the misconfigs
Of 43 NVD records matching "supabase", 4 are in Supabase's own code, all Low or Medium. Most data leaks come from RLS and key mistakes in apps.
SupabaseCVESecurityDependenciesRLS - ·8 min read
Supabase column-level security: why REVOKE does nothing
A column REVOKE does nothing while the role holds Supabase's default table-level grant. Revoke the table privilege, then grant only the allowed columns.
SupabasePostgresRLSGrantsSecurity - ·8 min read
Fix Supabase "Forbidden use of secret API key in browser"
Supabase refuses a secret key sent with a browser User-Agent. Either the key reached the browser, so rotate it, or your server code looks like a browser.
SupabaseAPI KeysSecretsEdge Functions - ·8 min read
Supabase "Hook requires authorization token": the fix
Supabase Auth shows "Hook requires authorization token" when your hook returns a 401. Auth sends no Authorization header, so verify the webhook signature.
SupabaseAuthEdge FunctionsWebhooks - ·9 min read
Query Supabase auth.users table without leaking emails
You can't query auth.users from supabase-js, and the usual workarounds leak every email. Use a profiles table, join on it, and keep listUsers server-side.
SupabaseAuthRLSPostgresSecurity - ·9 min read
"Signups not allowed for this instance": Supabase fix
Sign-ups are switched off: "Allow new users to sign up" under Authentication → Sign In / Providers, or enable_signup in config.toml. Existing users can still sign in.
SupabaseAuthRLSAuth HooksSecurity - ·8 min read
Refusing to check out fork pull request code: the fix
actions/checkout now refuses fork PR code in pull_request_target workflows. Setting allow-unsafe-pr-checkout reopens the hole; here is the safe fix.
GitHub ActionsCISecretsSupply Chain