Security
for builders.

Evidence

**2 table(s) returned data** with the anon key via PostgREST

### api_keys (6 total rows)
Columns: id, org_id, name, key_hash, key_prefix, created_at
Sample: { org_id: "a1b2c3", name: "Production API Key", key_hash: "sha256:..." }

### users (142 total rows)
Columns: id, email, name, role, created_at
Sample: { email: "john@acme.com", name: "John Smith", role: "admin" }

How to Fix

Enable RLS on all tables:

ALTER TABLE api_keys ENABLE ROW LEVEL SECURITY;
ALTER TABLE users ENABLE ROW LEVEL SECURITY;

Then add policies that restrict access to authenticated users who own the data.

Evidence

Login endpoint: /api/auth/login
Sent 30 rapid POST requests
Responses: [200, 200, 200, 200, 200, ...]
429 responses: 0/30

No rate limiting headers detected.
No account lockout after 30 failed attempts.

How to Fix

Add rate limiting to your login endpoint:

- Max 5 failed attempts per 15 minutes per IP
- Return HTTP 429 after limit reached
- Consider adding CAPTCHA after 3 failures

Evidence

No Content-Security-Policy header found.

Response headers:
  strict-transport-security: max-age=63072000
  x-frame-options: DENY
  x-content-type-options: nosniff
  content-security-policy: (not set)

How to Fix

Add a Content-Security-Policy header. Start with:

default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' https://*.supabase.co;