Sign-ups without email confirmation
Anyone can create an account with an email address they don't own.
Where it shows up: Supabase Auth
Last updated
What it is
When email confirmation is off, new accounts are active the moment they're created, without proving the person controls the email address.
It's often switched off during development to make testing faster and never switched back on.
What an attacker sees
Someone can sign up as ceo@yourcustomer.com, or as thousands of throwaway addresses. That enables impersonation, spam and abuse of anything your app gives to new accounts.
How to fix it
Paste this into your AI tool:
Enable email confirmation for sign-ups in my Supabase project, so new accounts must verify their email before they are active.
Or by hand:
- In Supabase → Authentication → Providers → Email, turn on Confirm email.
- Re-scan to confirm.
Check your app
Shippable reads your Supabase project's public auth settings and checks whether new accounts are confirmed automatically.
Scan your dev server before you push. No account needed:
Or scan your live app in the browser: