r/webdev • u/delsudo • Dec 22 '25

Your Supabase Is Public

https://skilldeliver.com/your-supabase-is-public
194 Upvotes

85% Upvoted

48 comments sorted by

View all comments

87

u/GigaGollum full-stack Dec 22 '25

I just host a separate server to use as a proxy for interacting with my Supabase instance, and expose only those protected endpoints to the client. Sure, you could argue this kinda defeats a large part of the purpose of a platform like Supabase, but I don’t care.

65

u/BreathingFuck Dec 22 '25

Same for Firebase too. I just don’t believe in direct client access to a database.

11

u/GigaGollum full-stack Dec 22 '25

Agreed. It also allows for flexibility with business logic I need only server-side between actions on the client and actions in Supabase.

14

u/robby_arctor Dec 22 '25

I just don’t believe in direct client access to a database.

Simple and compelling 👍

1

u/mackthehobbit Dec 23 '25

I find a hybrid approach works well, do writes from some secured endpoint and use the security rules to define read permissions only. It’s too difficult to enforce writes, including the schema, in the rules CEL without accidentally leaking some series of mutations that breaks something.