How to secure a Supabase app you build with Tempo

Does Tempo connect to Supabase today?

No. The current Tempo product is a local desktop app that runs Claude or Codex agents on your repository, and its docs do not mention Supabase. The earlier web editor had a Supabase integration: you authorized your Supabase account, picked a project, and Tempo generated the schema, typed data handlers and real-time updates. Tempo's migration guide says the web editor was wound down.

What should I look for in a Tempo pull request?

• A create table with no enable row level security in the same migration.
• An update policy with using but no with check.
• A new view without security_invoker.
• A secret or service_role key in client code or a client-exposed variable.
• verify_jwt = false on an Edge Function.

# Show the RLS-related lines a branch adds to Supabase migrations.
git diff origin/main...HEAD -- supabase/migrations/ \
  | grep -inE "create table|enable row level security|create policy|security_invoker"

How do I audit an app from Tempo's legacy web editor?

Run these in the Supabase SQL editor. The first lists tables without RLS. The second lists policies that let every row through.

-- Tables in public without RLS. This must return no rows.
select c.relname
from pg_class c
join pg_namespace n on n.oid = c.relnamespace
where n.nspname = 'public' and c.relkind = 'r' and not c.relrowsecurity;

-- Policies that pass for every row.
select tablename, policyname, cmd, roles
from pg_policies
where schemaname = 'public'
  and (qual = 'true' or with_check = 'true');

alter table public.events enable row level security;

create policy "events: owner reads" on public.events
  for select to authenticated
  using ((select auth.uid()) = user_id);

create policy "events: owner inserts" on public.events
  for insert to authenticated
  with check ((select auth.uid()) = user_id);

create policy "events: owner updates" on public.events
  for update to authenticated
  using ((select auth.uid()) = user_id)
  with check ((select auth.uid()) = user_id);

How do I keep secret keys out of the client?

Search the source and the build output for a secret key on every branch an agent touches. A publishable key in client code is expected. A secret key there is a leak to rotate.

# Look for a secret key before you deploy. This must print nothing.
grep -rnE "sb_secret_|service_role" --exclude-dir=node_modules --exclude-dir=.git . 2>/dev/null

What should I run after merging a Tempo pull request?

1. Apply the migration to a development project first.
2. Run the RLS query above. It must return no rows.
3. Run the Supabase Security Advisor.
4. Let Supahound's daily posture scan confirm no newly exposed tables reached production.