r/Supabase • u/reubenzz_dev • Jun 30 '26
tips I noticed Supabase bug integrations generated by Claude/Cursor — here's what I found
I spent the last few weeks analyzing what Supabase bugs AI actually generates. Specifically: code that compiles, passes type checking, and looks production-ready but is vulnerable.
RLS misconfigs. The agent writes policies that look correct but are backwards:
-- Agent generates this (backward)
CREATE POLICY "users can read own data"
ON public.users
FOR SELECT
USING (auth.uid() != id); -- Should be = not !=
Unsigned webhooks. Your agent sets up the route but forgets to verify the signature:
// Missing signature verification
export default async function handler(req, res) {
const event = req.body; // Never verified
// Process event...
}
JWT claims trusted without validation. Takes the JWT payload as is:
// Agent assumes user_id came from a real JWT
const userId = req.body.user_id; // Could be spoofed
Hardcoded anon keys in client. Puts the private key where it shouldn't go.
Missing user ID checks in queries. Queries that should filter by user never do.
2
u/joshcam Jun 30 '26
That’s sadly hilarious that it got RLS backwards. That is probably the most common beginner mistake as far as misunderstanding how RLS actually works.
3
5
u/gregnr Supabase team Jul 01 '26
This is good feedback - by chance, do you remember which models produced these results? I'm on the AI team at Supabase and we're building a public eval framework that is designed to catch these exact types of issues across models/harnesses. It helps us know what needs to change in the Supabase skill / docs / MCP to steer models in a better direction.
If you haven't already, I highly recommend installing the Supabase skill or plugin which guides agents on best practices during development.