Scope
List tables, storage buckets, RPCs, and roles that touch customer data.
Test Supabase RLS policies, service-role usage, RPCs, storage rules, and tenant isolation before launch.
Page intent
resourceA focused checklist for proving Supabase row-level security before customer data or tenant boundaries depend on it.
List tables, storage buckets, RPCs, and roles that touch customer data.
Create allow and deny test cases for each tenant-sensitive path.
Fix policies and server code that depend on client-side filtering.
Store a role-by-role RLS evidence matrix.
The value of a guide is not the document itself; it is the scan scope, fix ownership, retest criteria, and evidence it helps the team produce.
A focused checklist for proving Supabase row-level security before customer data or tenant boundaries depend on it.
Test table policies with anon, authenticated, member, admin, and cross-tenant accounts.
Review service-role usage, edge functions, RPCs, and generated queries.
Supabase RLS test matrix
Supabase RLS test matrix
cross-tenant denial screenshots
service-key usage review
policy exception log
Policies allowing reads across organizations when UI filters look correct.
Service-role keys leaking into runtime paths that should use user context.
RPC functions bypassing expected table policies.
Storage objects exposing tenant files through public buckets or weak rules.
Policies allowing reads across organizations when UI filters look correct.
Service-role keys leaking into runtime paths that should use user context.
Supabase RLS test matrix
RPC functions bypassing expected table policies.
Start with tables and storage paths that contain customer, organization, billing, or private user data.
No. RLS must be tested directly through database paths, API behavior, RPCs, and storage access.
Keep service-role usage server-side, narrow its purpose, and review every path that can act outside user context.
SafeVibe produces role-based checks, denial evidence, remediation notes, and buyer-safe proof of tenant boundaries.
Use Supabase RLS security checklist as the starting point, then turn the checklist into SafeVibe scan scope and remediation evidence.