2026-11-04 · Daily security tips

Can a stranger sign up to your "private" app?

Lots of AI-built apps are meant for a small group: an internal dashboard, a client portal, an admin tool. The sign-up form gets removed, but the auth provider still accepts new accounts. With Supabase, anyone holding your public anon key can call the sign-up endpoint directly.

That matters because policies often say "any logged-in user can read this". Once a stranger creates an account, they are a logged-in user.

Check: in Supabase open Authentication > Sign In / Providers and see whether "Allow new users to sign up" is on. Then look for RLS policies for the authenticated role whose condition is just true.

Fix: turn off new sign-ups and invite users instead, or keep sign-ups on and scope every policy to the row owner or an explicit allowlist.