Cursor + Supabase
Monitor the Supabase backend of an app you build in Cursor
Cursor has no database of its own. Supabase arrives through a Marketplace plugin, made by Supabase, that gives Cursor's agent the MCP server and Supabase's skills. That agent can write and run SQL, so a table can ship without RLS, and a General Analysis demo showed what a service_role connection can leak. Supahound checks every table's RLS daily and alerts when your secret key turns up somewhere new.
Last updated
Cursor works with Supabase when you connect it yourself.
What are the Supabase security risks in Cursor apps?
An MCP connection with more access than the task needs
The Supabase plugin in the Cursor Marketplace bundles the Supabase MCP server, and you can also add the server to .cursor/mcp.json. Supabase names prompt injection as the main LLM-specific attack on MCP. It advises scoping the server to one project, using read-only mode, and connecting to production only when a task needs it.
Service-role access while the agent reads user content
In a July 2025 research demonstration by General Analysis, Cursor's agent used the Supabase MCP server as service_role, read a support ticket with hidden instructions, and copied a private integration_tokens table into the ticket thread. No customer breach was reported. The lesson is about the connection, not the editor: an agent that bypasses RLS should not read text an attacker can write.
Tables from Cursor-written SQL start with RLS off
When Cursor's agent writes a create table migration, Supabase does not turn RLS on for that table. Only tables made in the Dashboard Table Editor get RLS automatically. Security Advisor rates a public table without RLS as ERROR (lint 0013), because anyone with the project URL can create, read, update and delete its rows.
A secret key in a NEXT_PUBLIC_ or VITE_ variable
If a Cursor edit puts a sb_secret_ or service_role key in a client-exposed variable, the key ships in your bundle. It maps to service_role, which has BYPASSRLS. Supabase rejects a secret key sent from a browser with HTTP 401, but that check reads the User-Agent, so a copied key still works from a script.
Views that return every row
Postgres creates views as security definer, usually owned by postgres. A view Cursor adds over an RLS table can therefore return rows the caller could never read from the table itself. Security Advisor flags this as lint 0010. The fix is security_invoker = on.
How does Supahound protect your Cursor app?
- The free daily posture scan lists every table without RLS, so a table from a Cursor migration shows up in the next scan.
- The same scan lists views without security_invoker and includes your Security Advisor findings.
- The service-key detector alerts from day one when a secret key is used from a browser or from a network the project has not seen, which is how a leaked NEXT_PUBLIC_ key shows up in traffic.
- The scraping and bulk-export detector learns each actor's normal volume for 7 days, then flags one actor reading far more rows than usual.
- Each incident comes with a plain-English summary and a paste-ready SQL fix you can review in Cursor before you apply it.
Frequently asked questions
- Does Cursor check my Supabase RLS policies?
- No. Cursor has no built-in RLS generation or Supabase security scan. The Supabase plugin adds Supabase's skills, including Postgres best practices, and its MCP server can surface Supabase advisors when you ask. Supahound runs its posture scan every day without a prompt.
- Should I connect the Supabase MCP server in Cursor to production?
- Only when a task needs it. That is Supabase's own advice. For daily work, scope the server to a development project and turn on read-only mode, and never give the agent a service_role connection while it reads data your users wrote.
- Can Supahound stop Cursor's agent from changing my database?
- No. Supahound detects; it does not block. It watches your project's traffic and alerts on database tampering from day one, with a summary and a SQL fix. You decide what to roll back.
- Does Supahound connect through the Supabase MCP server too?
- No. Supahound uses read-only Supabase OAuth with the read-only analytics:read, database:read and projects:read scopes and never asks for a service-role key. It reads edge logs and the schema, not your Cursor workspace.
Watch your Cursor app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.