Description

Ensure the Data API's Exposed schemas list contains only the schemas that client applications are meant to access. Schemas holding internal or sensitive tables should not be exposed, and the Data API should be disabled entirely if the project never uses it.

Rationale

Every schema in the Exposed schemas list can be reached through the REST and GraphQL APIs using the public key. If internal schemas are exposed, their tables and functions become reachable from the internet and depend entirely on RLS for protection. Exposing only the schemas that are needed reduces the attack surface of the project.

Impact

  • Limits what can be reached through the Data API

  • Keeps internal tables private

  • Clients that use a removed schema will stop working

Default Value

By default, the public and graphql_public schemas are exposed through the Data API.

Pre-Requisites

  • Project Owner or Admin role

  • A list of schemas clients need to access

Test Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open the Data API settings (Project Settings > Data API, or Integrations > Data API > Settings).

  4. Review the Exposed schemas list.

  5. If a schema is exposed that clients do not need, follow the implementation steps.

Implementation Steps

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open the Data API settings (Project Settings > Data API, or Integrations > Data API > Settings).

  4. Remove the schemas that should not be exposed from Exposed schemas.

  5. Select Save.

  6. If the project never uses the Data API, disable it in the same settings.

Backout Plan

  1. Sign in to the Supabase Dashboard at https://supabase.com/dashboard.

  2. Select your project.

  3. Open the Data API settings.

  4. Add the removed schema back to Exposed schemas.

  5. Select Save.

Reference