Notes
What your public site can leak.
Short, practical write-ups for people shipping Next.js on Vercel with Supabase or Neon. How to check RLS, client bundles, Storage, and Auth — then close the holes.
8 Oct 2026
Start here
How to tell if your Supabase tables are readable with the anon key
The publishable key in your Next.js app is not a secret. Check grants and RLS, then prove it with curl against the REST API.
15 Oct 2026
Is your Neon connection string in your Next.js bundle?
A Neon DATABASE_URL is a role and a password. How it lands in a Vercel client bundle, how to grep .next/static, and how to rotate the role without dumping rows.
8 Oct 2026
How NEXT_PUBLIC_ puts secrets in your Next.js client bundle
Next.js inlines NEXT_PUBLIC_ values into browser JS at build time. How to find a leaked key in .next/static, why service_role is a takeover, and how to rotate.
8 Oct 2026
Lock down Supabase Storage public buckets and listable objects
A public bucket skips read checks. A private bucket with a wide SELECT policy still lists every object. How to tell which one you have, and the SQL that closes it.
8 Oct 2026
Pre-launch security checklist for vibe-coded Vercel + Supabase apps
A last-pass checklist before you share a Next.js preview: client bundles, RLS, Storage, and Auth. Mechanisms you can test with curl, not a score you have to trust.
8 Oct 2026
Supabase Auth posture: open signup, anonymous users, and public profiles
/auth/v1/settings is readable with the project URL plus the public (anon/publishable) key. How to read disable_signup, anonymous sign-in, and autoconfirm, what to change in the Dashboard and SQL, and how profile tables leak.