Supabase Practice

• · SB1 — RLS is enabled on every table containing real user data, from the moment the table is created — never deferred to "before launch."
• · SB3 — service_role key never reaches client-side code — browser bundles, mobile app binaries, or any client-inspectable surface.
• · SB4 — Policies are tested with multiple user identities, not just verified to "look right" by reading the SQL — an actual query as user A attempting user B's data.
• · SB5 — Storage buckets have policies matching their sensitivity (public buckets are a deliberate choice, not a default; private buckets have RLS-equivalent storage policies).
• · SB6 — Edge functions handle logic that RLS can't express (cross-table business rules, third-party integrations, service_role-requiring operations) rather than routing around RLS with elevated client keys.

• · New table created → check RLS status immediately, before writing any query against it — ALTER TABLE x ENABLE ROW LEVEL SECURITY; is step one, not a later step.
• · Grep client-side code (frontend bundle, mobile app) for service_role or the service key pattern — it should never appear there.
• · Test every policy as an actual "attacker": log in as user A, attempt to read/write user B's row via the client SDK directly — RLS violations are invisible in code review but obvious in this test.
• · A feature needing "just this one query to bypass RLS for convenience" → that's an edge function candidate, not a client-side service_role leak.
• · Storage bucket created → is it public or private, and does that match what should actually be publicly fetchable?

• · Ver anti-patrones específicos del dominio en el pack.

• [ ] RLS enabled on every table with user-scoped/sensitive data. (SU1)
• [ ] Explicit, correctly-scoped policies for every operation the table needs. (SU2)
• [ ] service_role key never present in client-shipped code. (SU3)
• [ ] Policies reference auth.uid()/real scoping, not always-true placeholders. (SU4)
• [ ] Policies tested with multiple real authenticated identities. (SU5)
• [ ] Storage buckets explicitly public/private with matching policies. (SU6)

• Supabase Documentation

Este pack cita las siguientes fuentes registradas en el índice bibliográfico:

• webRow Level Security guideSupabase
• webSupabase DocumentationSupabase