supabase checks
34 articles
- Ensure MFA is enabled for organization members
- Ensure SSO/SAML is enforced for organization login
- Ensure publishable/secret API keys are rotated periodically
- Ensure legacy anon/service_role API keys are not still in use
- Ensure Row Level Security (RLS) is enabled on all public schema tables
- Ensure RLS-enabled tables have at least one defined policy
- Ensure views/functions using SECURITY DEFINER are reviewed
- Ensure Postgres functions have an explicit, fixed search_path
- Ensure extensions are not installed in the public schema
- Ensure SSL/TLS is enforced for all Postgres connections
- Ensure database network restrictions (IP allowlist) are configured
- Ensure Point-in-Time Recovery (PITR) is enabled
- Ensure automated daily backups are enabled and retained
- Ensure the Postgres engine version is current / not end-of-life
- Ensure query/audit logging is enabled for the database
- Ensure email confirmation is required before sign-in
- Ensure leaked-password protection (HaveIBeenPwned check) is enabled
- Ensure minimum password length is 12+ characters
- Ensure MFA is available/enforced for application end-users
- Ensure CAPTCHA is enabled on signup/login/password-reset
- Ensure JWT expiry is set to a reasonable, non-excessive duration
- Ensure a custom SMTP provider is configured for auth emails
- Ensure Site URL and redirect URLs are restricted to trusted domains
- Ensure anonymous sign-ins are disabled unless explicitly required
- Ensure rate limits are configured on OTP/signup/token endpoints
- Ensure storage buckets are private unless explicitly required to be public
- Ensure file size and MIME-type upload limits are configured
- Ensure only intended schemas are exposed via the Data API
- Ensure Realtime channels respect table RLS policies
- Ensure Edge Functions verify JWT unless intentionally public
- Ensure log retention period meets compliance/operational needs
- Ensure manual account linking is disabled unless required
- Ensure password changes require current password or reauthentication
- Ensure custom domain SSL is fully verified, not left in a pending/failed state