Connect Supabase

Sentrail connects through Supabase OAuth and the Management API. It does not ask you to paste a database password or connection string. The person authorizing the connection must be able to see the Supabase project being linked.

1. 01

   Authorize Supabase

   From the project's Connections view, choose Connect Supabase and complete the Supabase authorization flow.
2. 02

   Choose a project

   Select the Supabase project ref that belongs to this Sentrail project.
3. 03

   Run the RLS scan

   Collect table-level RLS state and policy-count evidence from non-system schemas in scope.
4. 04

   Run advisors

   Read current Supabase Security and Performance Advisor lints and persist relevant findings.

• Tables where Row Level Security is disabled.
• Tables where RLS is enabled but no policies exist.
• Supabase advisor lints such as exposed views, unsafe function search paths, and auth configuration concerns.
• Repository files and public-prefixed variables that appear to expose a service-role or other privileged credential.
• Security-sensitive migrations and database-boundary code in the linked GitHub repository.

Supabase's Data API uses two separate Postgres controls: grants decide whether a role can reach an object, while RLS policies decide which rows that role can access. Current Supabase guidance recommends using both for exposed objects.

alter table public.projects enable row level security;

create policy "Members can read their own projects"
on public.projects for select
to authenticated
using ((select auth.uid()) = owner_id);

Review the current Supabase Data API security guide and RLS documentation for platform behavior.

• Never expose a service-role or secret key in browser code; publishable and legacy anon keys depend on database authorization controls.
• Do not use user-editable user metadata for authorization decisions.
• Use both USING and WITH CHECK for ownership-constrained updates.
• Remember that updates also require a matching select policy.
• Treat security-definer functions and views as privileged surfaces and constrain their execution and schema exposure.