Using the Security Advisor
Supabase has a built-in system to detect potential threats within your database. You can find it within Database | Security Advisor. It is a list of advice, sorted by severity:
- Error: Something that should immediately have your attention
- Warning: Something that has less critical potential
- Info: About non-critical security knowledge.
How does it work though? For example, I have added a test RLS policy that uses the auth.jwt() -> 'user_metadata' expression. You’ve learned that the only metadata object on the user that is safe from being changed by the user is app_metadata and not user_metadata. The Security Advisor will detect that this is a security problem and list it in the Errors section:
Figure 12.13: Supabase’s Security Advisor
That being said, the Security Advisor is your best friend in regularly checking whether you have security-related issues in your database that you...
