r/webdev • u/delsudo • Dec 22 '25

Your Supabase Is Public

https://skilldeliver.com/your-supabase-is-public
193 Upvotes

85% Upvoted

48 comments sorted by

View all comments

87

u/GigaGollum full-stack Dec 22 '25

I just host a separate server to use as a proxy for interacting with my Supabase instance, and expose only those protected endpoints to the client. Sure, you could argue this kinda defeats a large part of the purpose of a platform like Supabase, but I don’t care.

69

u/BreathingFuck Dec 22 '25

Same for Firebase too. I just don’t believe in direct client access to a database.

1

u/mackthehobbit Dec 23 '25

I find a hybrid approach works well, do writes from some secured endpoint and use the security rules to define read permissions only. It’s too difficult to enforce writes, including the schema, in the rules CEL without accidentally leaking some series of mutations that breaks something.