The GuardLayer blog
Securing Next.js + Supabase, in depth
The specific mistakes that get apps on this stack hacked — and the exact fix for each. No generic checklists.
- ·6 min read
Vulnerable npm dependencies: catch them before they ship, not after
Most breaches start in node_modules, not your code. Here's how known-vulnerable npm packages slip past review — and how to stop them at the PR.
npmDependenciesNext.jsSupply Chain - ·5 min read
Your Supabase service role key is one NEXT_PUBLIC_ away from a full database breach
The Supabase service_role key bypasses every RLS policy. Here's exactly how it leaks into the browser, why it's catastrophic, and the precise fix.
SupabaseRLSSecretsNext.js