Overview
The Supabase integration provides comprehensive monitoring of your Supabase projects, including database security policies, user access, storage configurations, edge functions, and security analysis. LowerPlane syncs project data to evaluate security posture and support access reviews.Authentication
Supabase uses OAuth 2.0 for authentication. When you connect, you’ll be redirected to Supabase to authorize LowerPlane.Required Permissions (OAuth Scopes)
| Scope | What It Grants | Why LowerPlane Needs It |
|---|---|---|
read | Read project data | Access project metadata, configurations, and security settings |
projects | Read project list | Enumerate all projects in the organization |
What LowerPlane Collects
Project Info
Project metadata, region, status, and configuration
Organization Members
Member list with roles for access reviews and offboarding checks
Database Users
Database-level user accounts and authentication methods
Row-Level Security
RLS policies on all tables for data access governance
Edge Functions
Serverless function inventory and deployment status
Storage Buckets
Storage bucket configurations and access policies
Security Analysis
LowerPlane performs automated security analysis of your Supabase projects, checking for:- Tables without Row-Level Security (RLS) enabled
- Publicly accessible storage buckets
- Database users with excessive privileges
- Missing authentication requirements on edge functions
- Exposed API keys or service role misconfigurations
Critical System Access
Supabase is automatically registered as a critical system in your access review program. Both organization members and database users are synced for:- Periodic user access reviews
- Offboarded employee detection
- Role-based access monitoring
Security Tests
| Test | Severity | Description |
|---|---|---|
| User access should be valid | High | Verifies all Supabase users are identified |
| Access should be removed for offboarded users | Critical | Detects terminated employees with active access |
| RLS should be enabled on all tables | High | Checks Row-Level Security enforcement |
| Storage buckets should not be publicly accessible | High | Validates storage access controls |