supabase-security

Security Review — SvelteKit SPA + Supabase

This skill applies to a SvelteKit SPA (ssr = false) using Supabase Auth, Postgres with Row Level Security, and $env/dynamic/public for environment variables. All application code runs in the browser — there is no server middleware, no API routes, and no server-side rendering.

The trust boundary

The browser is untrusted. Supabase (Postgres RLS + Auth) is the only enforcement point. Every rule below follows from this.

UNTRUSTED                          TRUSTED
─────────────────────────────────  ──────────────────────────
Browser (SvelteKit SPA)            Supabase (Auth + Postgres)
 ├─ authState ($state)             ├─ JWT verification
 ├─ Zod validation (UX only)       ├─ RLS policies (auth.uid())
 ├─ Route guards (UX only)         ├─ DB constraints + CHECK
 └─ UI gating                      └─ Security definer RPCs

Client-side checks (auth guards, Zod schemas, route gating) improve UX but provide zero security. Assume an attacker can bypass every client-side check.

---

1. Row Level Security (RLS)

RLS is the authorization layer. Every table with user data MUST have RLS enabled.

Checklist for every new table

• ALTER TABLE ... ENABLE ROW LEVEL SECURITY;
• SELECT policy: using (auth.uid() = user_id_column)
• INSERT policy: with check (auth.uid() = user_id_column)
• UPDATE policy: using (auth.uid() = ...) with check (auth.uid() = ...)
• DELETE policy: using (auth.uid() = user_id_column)
• No policy grants access to anon role unless the data is intentionally public
• Column defaults cannot be abused (e.g., role text default 'admin' is dangerous)
• UPDATE policies restrict which columns can be changed when needed (use with check constraints)

Common mistakes

-- BAD: allows any authenticated user to read all rows
create policy "select_all" on items for select to authenticated using (true);

-- GOOD: scoped to the row owner
create policy "select_own" on items for select to authenticated
  using (auth.uid() = owner_id);

-- BAD: user can set arbitrary owner_id on insert
create policy "insert_any" on items for insert to authenticated
  with check (true);

-- GOOD: forces owner_id to match the authenticated user
create policy "insert_own" on items for insert to authenticated
  with check (auth.uid() = owner_id);