Securing Next.js + Supabase, in depth
The specific mistakes that get apps on this stack hacked — and the exact fix for each. No generic checklists.
- ·8 min read
Next.js Middleware Auth Bypass: CVE-2025-29927
A spoofable x-middleware-subrequest header let requests skip Next.js middleware, bypassing auth. Upgrade to the patched version; don't trust middleware alone.
Next.jsMiddlewareSecurityCVE - ·11 min read
Does Prisma respect Supabase RLS? No — here's why
Prisma and Drizzle connect as the postgres role and bypass Supabase RLS entirely, so your policies never protect ORM queries. Here's how to fix it.
SupabaseRLSPostgresPrismaDrizzle - ·9 min read
Fix: Stripe Webhook Signature Verification Failed
Stripe webhook signature verification failed in Next.js? The top cause is a parsed body — pass the raw request text to constructEvent. Full fix here.
Next.jsStripeWebhooksSecurity - ·13 min read
Supabase auth.uid(): what it returns, and why it's NULL
auth.uid() returns the signed-in user's UUID, and NULL when no user JWT reaches Postgres. How to fix it in the SQL editor (set role plus a sub claim) and in your app.
SupabaseRLSPostgresAuthNext.js - ·7 min read
Supabase CORS error in Next.js: the real fix
A Supabase CORS error in Next.js is usually a bad env var or missing grants, not CORS. Here is how to diagnose it and fix Edge Function CORS properly.
SupabaseNextjsCORSSecurityEdge-Functions - ·8 min read
Fix Supabase JWT Expired (PGRST301) in Next.js
A Supabase PGRST301 'JWT expired' 401 means the access token aged out with nothing refreshing the cookie, and the @supabase/ssr middleware fixes it.
SupabaseNextjsAuthJWTRLS - ·10 min read
Fix: new row violates row-level security policy
Supabase error 42501 on insert means RLS is on but the row failed a WITH CHECK policy. Add or fix an INSERT policy matching auth.uid().
SupabaseRLSPostgresAuthNext.js - ·7 min read
Supabase: permission denied for table (42501)
The 42501 permission denied for table error is a missing Postgres GRANT, not an RLS failure. Here is the exact SQL fix.
SupabasePostgresRLSPermissionsSecurity - ·10 min read
Why Supabase RLS queries are slow (and how to fix)
Supabase RLS queries are slow because auth.uid() re-runs per row and policy columns lack indexes. Here are the verified fixes with SQL.
SupabaseRLSPostgresPerformance - ·7 min read
Was Supabase hacked? No — why 16,326 databases were exposed
No reported breach of Supabase itself. The data leaks in the news, like UpGuard's 16,326 open databases, are apps with RLS off. One query checks yours.
SupabaseRLSSecurityData Breach - ·16 min read
Supabase "Function Search Path Mutable": meaning and fix
"Function has a role mutable search_path" means no search_path is pinned. Fix: set search_path = '' and schema-qualify names, SECURITY DEFINER first.
SupabasePostgresSecurityRLS - ·6 min read
Is Supabase Secure? What's Safe and What's on You
Yes — Supabase is SOC 2 Type II and safe for production. The risks that actually leak data are in your config: RLS, the service_role key, and exposed secrets.
SupabaseRLSSecuritySecrets - ·7 min read
Next.js App-Layer Security: Beyond RLS and Secrets
Once RLS and secrets are locked down, the Next.js app layer is where bugs hide: XSS, eval, CORS, input validation, dependencies. The footguns and the fixes.
Next.jsSecurityXSSCORS - ·6 min read
Snyk vs GitGuardian vs GuardLayer for Indie Devs
A head-to-head of Snyk, GitGuardian, and GuardLayer for solo devs: what each actually catches, verified 2026 pricing, and which fits a Next.js + Supabase stack.
SecurityToolsNext.jsSupabase - ·6 min read
Why a Static Scanner Can't Stop Prompt Injection
A static scanner has no runtime or taint analysis, so it can't detect prompt injection. Here are the 5 concrete things it does catch in AI-built apps instead.
AISecurityPrompt InjectionSupabase