Two exploits, one public API key: the day I attacked my own Supabase app

Short summary

The author discovered two exploitable vulnerabilities in their own production Supabase app using only the public anon key. A SECURITY DEFINER function with no ownership check let unauthenticated callers downgrade any paying subscription to trial. An RLS policy with USING but no WITH CHECK let members escalate themselves to admin. Both were fixed by revoking anon access and enforcing server-side authorization.

• •SECURITY DEFINER + grant to anon = unauthenticated billing manipulation
• •RLS for all with USING only and no WITH CHECK enables privilege escalation
• •Fix: revoke anon execute, route through service_role, add WITH CHECK clauses

Generated with AI, which can make mistakes.