Is the Supabase Security Advisor enough to secure my app?
It's a must-run first step, but not the whole picture. The Security Advisor checks your database configuration: RLS, policies, grants and functions. It doesn't look at your frontend code, your edge functions or your live site, which is where many AI-built apps leak.
Why
The Security Advisor (Advisors → Security Advisor in the Supabase dashboard, or supabase db advisors on the command line) runs lints against your database schema. It flags tables in the public schema with RLS off, RLS on with no policy, policies that are always true, SECURITY DEFINER views and functions that anon or signed-in users can call, function search paths that can be changed, sensitive columns exposed through the API, and public storage buckets that allow listing.
What it doesn't cover: a service_role or other secret key shipped in your browser JavaScript, edge functions that don't check who is calling, unsigned payment webhooks, .env files or source maps left public on your host, missing security headers, and libraries with known vulnerabilities. It also reads configuration rather than data, so a policy that passes every lint but still lets one user read another's rows won't show up.
Shippable checks from the outside, the way a stranger would. It reads your tables with only the public anon key and shows the rows that came back, looks for secret keys in your shipped JavaScript, and checks headers and exposed files. In your project folder (CLI or MCP) it also reviews your migrations, policies and edge function code. Run both: fix the Advisor's warnings, then scan to confirm nothing is still readable.
How to check
- Open Advisors → Security Advisor in the Supabase dashboard and fix every error and warning. Re-run it after each schema change.
- Search your built frontend for service_role and sb_secret_. Neither should ever appear in it.
- Scan your app with Shippable to see what an anonymous visitor can actually read, with proof for each finding.
More on this: Database tables anyone can read, from the Vibe-Code Top 10.
Check your app
Your first app is free, and it is read-only. You prove the app is yours with a one-line tag first.