Supabase

Security and best-practice rules for Supabase projects.

Enabled Rules

Rule	Severity	Description
`security/rls-required`	warn	Ensures Row Level Security is enabled on all tables
`security/secret-detection`	block	Detects Supabase service role keys in client code
`security/env-exposure`	block	Prevents server-only env variables in client bundles
`workflow/migration-safety`	warn	Flags dangerous SQL patterns (`DROP TABLE`, `TRUNCATE`)
`quality/no-console-log`	warn	Catches debug logging left in production code

import { defineConfig } from '@solanticai/vguard';

export default defineConfig({
  presets: ['supabase'],
});

Row Level Security — Every CREATE TABLE statement must be followed by RLS policies. Warns when tables are created without ALTER TABLE ... ENABLE ROW LEVEL SECURITY.
No service role key leaks — Blocks SUPABASE_SERVICE_ROLE_KEY or supabase.createClient(url, serviceKey) patterns in client-accessible code.
Env safety — Only NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_DEFAULT_KEY should appear in client code.
Migration safety — Warns on destructive SQL operations in migration files. Flags DROP TABLE, TRUNCATE, DELETE FROM without WHERE, and ALTER TABLE DROP COLUMN.
No debug logging — Catches console.log statements that may leak query results or auth tokens.