supabase-security-expert

Supabase Security Expert (2026 Edition — Auth v3 / PKCE)

English | Bahasa Indonesia

---

English

Orchestration & Integration

Connects and orchestrates with relevant domain skills like brainstorming, zero-to-prod-orchestrator, and project-context-mapper to ensure cohesive execution.

Description

Expert guide for auditing and hardening Supabase applications. Covers Row Level Security (RLS), Supabase Auth v3 (PKCE flow), API key hygiene, data leakage prevention, Supabase Linter, and production security checklists.

Trigger Conditions

• Auditing RLS policies for correctness and security gaps.
• Setting up Supabase Auth v3 with PKCE flow (replaces implicit flow).
• Reviewing API key usage (anon key vs. service role key).
• Preventing data leakage from misconfigured policies.
• Running Supabase Linter (supabase lint) for automated security checks.
• Implementing user roles and access control in a Supabase project.

Supabase Auth v3 — PKCE Flow (2026 Default)

Supabase Auth v3 now uses PKCE (Proof Key for Code Exchange) as the default flow for all OAuth and magic link authentication — replacing the older implicit flow:

// supabase/client.ts — v3 client setup
import { createBrowserClient } from '@supabase/ssr';

export const supabase = createBrowserClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
  {
    auth: {
      flowType: 'pkce', // Default in Auth v3
      autoRefreshToken: true,
      persistSession: true,
      detectSessionInUrl: true,
    }
  }
);

// Server-side session handling (Next.js App Router)
import { createServerClient } from '@supabase/ssr';
import { cookies } from 'next/headers';

export async function createSupabaseServerClient() {
  const cookieStore = await cookies();
  return createServerClient(
    process.env.NEXT_PUBLIC_SUPABASE_URL!,
    process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
    {
      cookies: {
        getAll: () => cookieStore.getAll(),
        setAll: (cookiesToSet) => {
          cookiesToSet.forEach(({ name, value, options }) =>
            cookieStore.set(name, value, options)
          );
        },
      },
    }
  );
}