How to secure your own Supabase project in a Firebase Studio app

Does a Firebase Studio app use Supabase?

Not by default. When an app needs a database or authentication, Firebase Studio's App Prototyping agent sets up Cloud Firestore and Firebase Authentication. Supabase only enters the app if you add it.

Google's docs also say new workspace creation and user signup are no longer supported, while existing workspaces still work. This guide applies to those existing workspaces.

Which Supabase key can go in a Firebase Studio app?

• Client code: the publishable key (sb_publishable_), which maps to the anon or authenticated role.
• Server code only: a secret key (sb_secret_), which maps to service_role and bypasses RLS.
• Legacy anon and service_role JWT keys: Supabase is deprecating them by the end of 2026. Use the new formats.

# Expect no output: no secret key in the built client.
grep -rlE "sb_secret_|service_role" dist/ build/ .next/static/ 2>/dev/null

How do I protect Supabase tables without Security Rules?

Supabase uses Postgres RLS. Enable it on each table, then write one policy per command that names the role and checks ownership.

create table public.profiles (
  id uuid primary key references auth.users (id) on delete cascade,
  display_name text
);
alter table public.profiles enable row level security;

create policy "profiles: self reads" on public.profiles
  for select to authenticated
  using ((select auth.uid()) = id);

create policy "profiles: self updates" on public.profiles
  for update to authenticated
  using ((select auth.uid()) = id)
  with check ((select auth.uid()) = id);

How do I lock down Supabase Edge Functions?

Edge Functions require a valid JWT in the Authorization header by default. Keep it that way for anything that reads or writes private data. Search for places that turned it off.

grep -rnE "verify_jwt *= *false|no-verify-jwt" supabase/ package.json 2>/dev/null

What should I check before publishing?

1. Run the RLS-off query and expect zero rows.
2. Open Security Advisor and clear lint 0013 (RLS disabled in public) and lint 0010 (security definer views).
3. Grep the build for secret keys.
4. Sign in as a test user and confirm you cannot read another user's rows.

-- Every table in public without RLS. Expect zero rows.
select c.relname
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;