20 Checks Before Your App Goes Live

Row level security is on for every table in the public schema.

Supabase dashboard, Table Editor: any table marked RLS disabled is readable by anyone holding your public anon key.

No policy uses using (true) on data that belongs to a user or a company.

Search your migrations for using (true) and with check (true). Each one should have a reason you can explain.

Policies check ownership, not just sign-in.

A policy that only checks auth.role() = 'authenticated' lets every signed-in user see every row. It should compare against auth.uid() or a membership table.

Update policies have a with check clause.

Without it, a user can move a row into another company by changing its owner column.

Users cannot change their own role.

If a members or profiles table holds the role, confirm a normal user cannot insert or update that column.

The service role key never reaches the browser.

Search your code for SERVICE_ROLE. In Next.js, any variable starting with NEXT_PUBLIC_ is sent to the browser. In Vite, the same applies to VITE_.

Secret files are in .gitignore.

Confirm .env and .env.local are listed. If a secret was ever committed, rotate it, because git history keeps it.

Payment and email API secret keys are server only.

Stripe, Razorpay and email provider secret keys should appear only in server routes or edge functions.

Admin pages are protected on the server.

If admin access depends on a value in local storage or a hidden button, any user can switch it on.

Email confirmation and password rules are set the way you intend.

Supabase dashboard, Authentication settings.

Redirect URLs are limited to your own domains.

Authentication, URL Configuration: the allow list should not contain wildcards you do not need.

One company can never see another company's data.

Create two test accounts in two test companies and try to open each other's records by changing IDs in the URL or the request.

Buckets with customer files are private.

Storage settings: a public bucket serves any file to anyone with the link, with no expiry.

Customer files are served through signed URLs.

Signed URLs expire. Permanent public links to invoices, IDs or documents do not.

Edge functions check who is calling.

A function that takes a user, company or role from the request body and acts on it with the service role key must first confirm the caller is allowed.

Functions only accept calls from your own domains.

Look for Access-Control-Allow-Origin set to * on functions that change data.

Payment webhooks verify the signature.

Stripe: stripe.webhooks.constructEvent with your webhook secret. Razorpay: validate the X-Razorpay-Signature header.

Backups or point-in-time recovery are on, and you have tried a restore.

Supabase dashboard, Database, Backups. A backup you have never restored is a guess.

Errors reach you before customers tell you.

Error monitoring with alerts on the front end and in functions.

Changes are tested somewhere other than production.

A separate staging project, so a migration mistake never lands on live data first.