Security Scan Report

Supabase anon key exposed in JavaScript bundle

Combined with missing RLS, anyone can query your entire database without authentication.

Enable Row Level Security on all Supabase tables. Go to Table Editor → select each table → toggle Enable RLS. Add policies using auth.uid() = user_id to restrict each user to their own rows. Confirm no table returns data without an auth token.

Row Level Security not detected on Supabase tables

Any authenticated user can SELECT * from any table and retrieve all records.

Enable RLS on every Supabase table and add per-user access policies. Use the SQL editor to run: ALTER TABLE users ENABLE ROW LEVEL SECURITY; then CREATE POLICY for each table.

Wildcard CORS policy on /api routes

Any website can make authenticated API requests on behalf of your logged-in users.

Replace Access-Control-Allow-Origin: * with your specific domain in next.config.js. Set headers in the async headers() function targeting /api/:path* routes.

Missing Strict-Transport-Security header

Browsers won't enforce HTTPS-only connections, enabling man-in-the-middle attacks on public WiFi.

Add Strict-Transport-Security: max-age=31536000; includeSubDomains to your response headers in next.config.js.

No Content-Security-Policy header

XSS attacks can load external scripts without restriction, enabling session hijacking.

Add a Content-Security-Policy header in next.config.js. Start with: default-src 'self'; script-src 'self' 'unsafe-inline'; then tighten as needed.