Guide Supabase

Think someone got into your Supabase database? What to do first (Lovable and Bolt apps)

By the PatchAndShip team Last verified:

Short answer

First, stop more data from leaving, then find out what was reached, then decide who to tell.

What to do, in order

  1. Close the door: turn on access rules (RLS) for every table the Security Advisor flags, and remove any rule that lets everyone read private data. If a secret key (a service_role or sb_secret_ key) was in your site's code, replace it (rotate it) now.
  2. Look at what happened: check the API logs and Auth logs in your Supabase dashboard for unknown visitors, bulk reads, new accounts or role changes. Logs only go back as far as your plan keeps them, so save what you see. Download them as CSV or JSON.
  3. Tell people if you need to: if personal or payment data may have been read, get advice on your notification duties where you and your users live.
  4. Test again with two accounts and signed out before you reopen sign ups.

We give no legal advice. Our Security Fix closes the holes; it is not incident response or forensics. For a quick outside look at your site, use our free check for exposed keys and missing security headers.

Where we can help

Free instant check: paste your URL at patchandship.com/check.html to scan your homepage's JavaScript for secret keys and security headers (no signup, nothing stored). Paid, fixed price per app: Database Check, $49; Security Fix, $149 (every critical issue on our checklist fixed within 48 hours of working access); Fix & Deploy, $249. Otherwise a full refund if you ask within 14 days of purchase (Refund Policy). AI agents run the checks and a human engineer approves every change. Not a penetration test or a security guarantee.

FAQ

How far back do Supabase logs go?

Retention depends on your plan, so save what you see as soon as you can.

Should I rotate my anon key?

Rotating the public anon key doesn't close an open table. Fix the access rules. Rotate secret keys (service_role or sb_secret_) if they were exposed.

Do I have to tell my users?

It depends on what data was reached and where you and your users live. Get advice on your notification duties.

Sources