How to secure a Same.new + Supabase app

How does Same connect to Supabase?

1. Open the Tools panel and find the Supabase card.
2. Click Add Supabase and authorize. This connects the Supabase MCP server.
3. Prompt Same to build. It creates the Supabase project, designs the schema and runs the migrations.

How do I limit what the Supabase MCP connection can do?

Supabase's MCP guide names prompt injection as the main LLM-specific attack. Its advice applies to the connection Same uses.

• Scope the connection to one project, not the whole organization.
• Use read-only mode for any routine that runs without you watching.
• Build against a development project. Connect production only when a task needs it.

How do I find tables Same created without RLS?

Run the query in the Supabase SQL editor after each prompt that changes the schema. Enable RLS and add policies for every table it returns.

-- Tables in public without RLS. This must return no rows.
select c.relname
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;

alter table public.posts enable row level security;

create policy "posts: owner reads" on public.posts
  for select to authenticated
  using ((select auth.uid()) = user_id);

create policy "posts: owner inserts" on public.posts
  for insert to authenticated
  with check ((select auth.uid()) = user_id);

create policy "posts: owner updates" on public.posts
  for update to authenticated
  using ((select auth.uid()) = user_id)
  with check ((select auth.uid()) = user_id);

How do I check views in a Same schema?

Postgres creates views as security definer, so a view on an RLS table can return every row. The Security Advisor flags these with lint 0010. List your views, then set security_invoker on each one.

-- Views in public and their options.
-- A view without security_invoker=true (or =on) runs as its owner and skips RLS.
select c.relname, c.reloptions
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'v';

alter view public.post_feed set (security_invoker = on);

What should I check before deploying a Same app?

1. Run the RLS and view queries above.
2. Run the Supabase Security Advisor and fix every ERROR-level finding.
3. Search the source for a secret key with the command below.
4. After deploying, run the free /hack-me scan on your domain.

# Look for a secret key before you deploy. This must print nothing.
grep -rnE "sb_secret_|service_role" --exclude-dir=node_modules . 2>/dev/null