Does Tempo still connect to Supabase?

Not in the current product. Tempo's desktop app docs do not mention Supabase. The Supabase connect flow was part of the web editor, which Tempo's migration guide says was wound down.

I built my app in Tempo's old web editor. What should I check?

Check RLS on every table, the policies on each one and any views. Run a catalog query for tables without RLS and the Supabase Security Advisor, then connect the project to Supahound for the daily posture scan.

Does Supahound review Tempo's pull requests?

No. Supahound reads your Supabase project, not your repo: a daily posture scan of the schema and, on paid plans, the edge logs. It works whichever editor or agent wrote the code.

Tempo + Supabase

Monitor the Supabase project behind an app you build with Tempo

Tempo today is a desktop app that runs Claude or Codex agents on your repository and turns issues into pull requests. It has no Supabase integration of its own; the Supabase connect flow belonged to Tempo's legacy web editor. If your codebase runs on Supabase, watch for agent migrations that create tables without RLS. Supahound scans for those tables daily and watches live traffic.

Last updated 2026-11-09

Start free Read the Tempo security guide

Tempo does not use Supabase by default. These pages apply when you connect your own Supabase project.

What are the Supabase security risks in Tempo apps?

Apps from the legacy web editor
Tempo's retired web editor connected to Supabase and generated the database structure, typed data handlers and real-time updates. No Tempo doc describes RLS for that schema, so those apps run with whatever RLS state it had.
Agent-written migrations
Tempo's desktop agents can write SQL migrations in your repo. Supabase does not enable RLS on tables created with SQL, so a merged pull request can add an open table.
A secret key in a client-exposed variable
Tempo works on your existing codebase, whatever framework it uses. An agent that puts a secret or service_role key into a variable your framework ships to the browser gives every visitor a key that skips RLS.

How does Supahound protect your Tempo app?

The free daily posture scan reports newly exposed tables, so a merged migration without RLS shows up the next day.
The same scan reports RLS coverage, Security Advisor findings and views without security_invoker for schemas the legacy web editor generated.
The service-key detector flags a secret key used from a browser or a new network, the trace an agent-written client variable leaves.
From day one, the cross-tenant read detector flags a user who reads across tenants through a policy a pull request loosened.

Frequently asked questions

Does Tempo still connect to Supabase?: Not in the current product. Tempo's desktop app docs do not mention Supabase. The Supabase connect flow was part of the web editor, which Tempo's migration guide says was wound down.
I built my app in Tempo's old web editor. What should I check?: Check RLS on every table, the policies on each one and any views. Run a catalog query for tables without RLS and the Supabase Security Advisor, then connect the project to Supahound for the daily posture scan.
Does Supahound review Tempo's pull requests?: No. Supahound reads your Supabase project, not your repo: a daily posture scan of the schema and, on paid plans, the edge logs. It works whichever editor or agent wrote the code.

Watch your Tempo app's Supabase traffic

Connect your Supabase org read-only. The free posture scan runs in minutes. No credit card.

Start free See pricing

Sources

Checked on 2026-11-09. Products change; check each source for current details.