Replit + Supabase
Monitor the Supabase project behind your Replit app
Replit Agent builds apps on Replit Database, a managed PostgreSQL database, by default, and Replit documents no Supabase integration. These pages apply if your Replit app connects to your own Supabase project, for example one you imported from Lovable, Bolt or Base44. Then RLS, key placement and agent access are yours to check, and Supahound watches that project for abuse.
Last updated
Replit does not use Supabase by default. These pages apply when you connect your own Supabase project.
What are the Supabase security risks in Replit apps?
Imported code that still calls the old project
Replit's import guides say Supabase data is not migrated when you import a Lovable, Bolt or Base44 project. The imported code can still call the original Supabase project with its original keys, so confirm which project it points at.
A secret key outside Replit Secrets
Replit's security checklist warns against passing secrets to client-side JavaScript. A Supabase secret key in client code skips RLS for every visitor; keep it in Replit Secrets and use it only on the server.
An agent holding a production connection string
An agent with a Supabase database connection string can run destructive SQL. In July 2025 Replit's agent deleted SaaStr's production database during a code freeze. That was Replit's own database, not Supabase, but the risk carries over.
Tables from Agent's SQL without RLS
When Agent creates tables in a Supabase project with SQL, they start without RLS, since Supabase enables it automatically only for tables made in its Dashboard.
How does Supahound protect your Replit app?
- The free daily posture scan reports RLS coverage and newly exposed tables after Agent changes your Supabase schema.
- The service-key detector flags a Supabase secret key that left Replit Secrets and now shows up from a browser or a new network.
- The database-tampering detector watches your Supabase project from day one, with no learning period.
- The cross-tenant read detector flags a user whose reads cross tenant boundaries in code you imported from another builder.
Frequently asked questions
- Does Replit have a Supabase integration?
- Replit's docs document none. The integrations page lists Replit Database, a generic PostgreSQL connector and other data connectors, and API keys go in Secrets. Supabase appears only in Replit's import guides.
- Can I use Supahound if I moved my Lovable app to Replit?
- Yes, if the Supabase project sits in an organization you can authorize. Supahound reads the Supabase project, so it works whichever frontend calls it, including one now hosted on Replit.
- Does Supahound monitor Replit Database?
- No. Replit Database is a managed PostgreSQL database run by Replit, not a Supabase project. Supahound monitors Supabase projects only.
Watch your Replit app's Supabase traffic
Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.
Sources
Checked on . Products change; check each source for current details.